🔒 Add request size limit to daemon socket IPC to prevent OOM panic (#31)

The daemon was allocating memory based on an unverified length prefix
sent over the unauthenticated Unix socket, potentially allowing a malicious
client to cause an Out-Of-Memory panic (DoS). A 10 MB size limit has been
introduced.

Note: The previously reported `unwrap()` panic on invalid JSON payloads
was already fixed and replaced with a safe `match` block in a prior commit.

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>

src/bin/daemon.rs

@@ -89,6 +89,11 @@ async fn commands_loop(listener: UnixListener) -> Result<(), Box<dyn Error>> {
 
             let request_len = u32::from_le_bytes(len_bytes) as usize;
 
+            if request_len > 10 * 1024 * 1024 {
+                eprintln!("Failed to read message from client: request too large ({} bytes)!", request_len);
+                return;
+            }
+
             let mut buffer = vec![0u8; request_len];
             if stream.read_exact(&mut buffer).await.is_err() {
                 eprintln!("Failed to read message from client!");