Audit fixes: account tests, dependencies and security hardening

[tyl-droid]

Audit fixes: stale account tests, dependency advisories, upload limit and strict JWT subjects

Hi — I reviewed the current main branch at bc12bb07d4055bf5d85943b67f7379d8ab440c22 as part of a preservation-readiness audit and reproduced a few concrete issues.

I prepared and validated three small commits locally:

1. Account test drift
   • Updates the account integration suite for the new default of three username changes.
   • Exercises all three successful changes and verifies the fourth is refused.
2. Dependency security updates
   • hono: 4.12.27 → 4.13.5
   • wrangler: 4.105.0 → 4.128.0
   • @scalar/api-reference: 1.63.0 → 1.67.0
   • Regenerated pnpm-lock.yaml.
   • pnpm audit --prod --audit-level=moderate changed from 12 advisories (3 high, 8 moderate, 1 low) to no known vulnerabilities.
3. Narrow security hardening
   • Adds RECFLARE_MAX_UPLOAD_BYTES with a safe 64 MiB default.
   • Returns HTTP 413 before writing an oversized parsed file to R2.
   • Documents the setting and adds an integration test.
   • Makes JWT sub parsing reject partial/non-canonical values such as 42junk, decimals, signed/zero-padded values and unsafe integers, instead of accepting parseInt's prefix.

Validation:

• 31/31 test files passed
• 1,264/1,264 tests passed
• Storage typecheck passed
• Storage lint passed
• Full lint completed with the same existing warnings
• Production dependency audit: 0 known vulnerabilities

One limitation remains: multipart parsing occurs before the per-file size check, so this prevents R2 storage abuse but does not fully eliminate request-body memory pressure. A follow-up should enforce an edge/request-body ceiling or introduce streaming multipart handling.

I can provide the three generated Git patches/commits for application. I have not deployed anything or changed upstream code.