Limit webhook body size to 1MB

Fixes #21
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/forgejo/webhook.go

@@ -39,7 +39,7 @@ func VerifyWebhookSignature(r *http.Request, secret string) ([]byte, error) {
 		return nil, fmt.Errorf("missing X-Forgejo-Signature header")
 	}
 
-	body, err := io.ReadAll(r.Body)
+	body, err := io.ReadAll(io.LimitReader(r.Body, 1<<20))
 	if err != nil {
 		return nil, fmt.Errorf("read body: %w", err)
 	}