security: limit HTTP request body size to prevent memory-exhaustion DoS

Handlers read the request body (settings, posts, imports, collections) via
io.ReadAll on r.Body without an explicit size limit, allowing an unbounded
request body to exhaust server memory (denial of service).

Register a gorilla/mux body-limit middleware on the root router in InitRoutes
that wraps each request body with http.MaxBytesReader (default 32M), covering
all routes including subrouters.