perf(api): add body size validation to notification/alert proxy routes

Problem

The notification and alert proxy routes forward request bodies as-is to the downstream notifications service without any size validation.

// proxy.route.ts
await req.text()  // reads full body without size check, then forwards it

These routes accept POST, PATCH, and DELETE methods and proxy the full body content.

Affected Routes

• POST /v1/notification-channels/*
• PATCH /v1/notification-channels/*
• DELETE /v1/notification-channels/*
• POST /v1/alerts
• PATCH /v1/alerts
• DELETE /v1/alerts

Suggested Fix

Add body size validation before proxying:

const body = await req.text();
if (body.length > MAX_PROXY_BODY_SIZE) {
  return c.json({ error: "Request body too large" }, 413);
}

Or apply the global body limit middleware (from #2582) which would cover these routes automatically.

Files

• apps/api/src/notifications/routes/proxy.route.ts

Context

Part of the API event loop performance audit.

Start in apps/api/src/notifications/routes/proxy.route.ts and inspect how the notification-channel and alert proxy routes read and forward request bodies. Compare the proposed local check with the global body limit middleware from #2582. Done means the affected POST, PATCH, and DELETE routes reject oversized bodies with status 413 while continuing to proxy acceptable bodies.