feat(backend): add request body size limit to prevent payload attacks

[omolobamoyinoluwa-max]

Summary

Express has no body size limit configured. A large signedXdr payload could cause memory pressure. Add express.json({ limit: '64kb' }).

Acceptance criteria

• Body size capped at 64kb
• Oversized requests return 413
• Test verifies rejection