fix(api): configurable body size limits for OpenAPI catch-all route - #5048

What is this PR about?

Application.dropDeployment 500s on any multipart upload today, since Next's default bodyParser consumes the stream before getMultipartBody can read it. Disabling bodyParser fixes that but drops trpc-openapi's JSON body limit to its internal 100KB default (no maxBodySize passed), breaking compose.import/processTemplate/previewTemplate on anything over 100KB. Multipart uploads also end up with no cap at all, since getMultipartBody ignores maxBodySize.

Pass maxBodySize explicitly and add a Content-Length guard for multipart. Both configurable via OPENAPI_MAX_JSON_BODY_SIZE / OPENAPI_MAX_UPLOAD_SIZE (default 10mb / 1gb).

Checklist

Before submitting this PR, please make sure that:

• You created a dedicated branch based on the canary branch.
• You have read the suggestions in the CONTRIBUTING.md file https://github.com/Dokploy/dokploy/blob/canary/CONTRIBUTING.md#pull-request
• You have tested this PR in your local instance. If you have not tested it yet, please do so before submitting. This helps avoid wasting maintainers' time reviewing code that has not been verified by you.

Issues related (if applicable)

closes #4236, #4315

Screenshots (if applicable)

Greptile Summary

The PR makes OpenAPI request-body limits configurable while preserving raw multipart streams.

• Disables Next.js body parsing for the catch-all OpenAPI route.
• Applies separate JSON and multipart upload limits.
• Requires multipart requests to provide a finite Content-Length.
• Validates configured limits as positive integers and otherwise uses defaults.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

_{Reviews (3): Last reviewed commit: "fix(api): reject non-integer body size e..." | Re-trigger Greptile}