fix: bound HTTP task request and response bodies

[RobLe3]

Summary

• enforce the stable HTTP task request/response resource boundary in reqwest and Axum paths
• fail declared oversize before body allocation and incrementally bound streamed bodies
• return structured errors and prevent oversized provider output from producing success metrics or receipts
• consume the shared protocol boundary fixture

Validation

• cargo test --locked
• cargo fmt --all -- --check
• cargo clippy --all-targets --all-features --locked -- -D warnings
• component quality runner from the committed clean tree

Implements the Rust portion of RobLe3/IICP#250. No crate publication, service restart, or deployment.