harden the reference backend: write bounds + CORS

The @pcbjam/backend-example server had a 1 GiB body limit, no per-owner/per-lib
quotas, bound to 0.0.0.0, and reflected any origin with credentials when
CORS_ORIGIN is *. Bound the write surface (5 MiB body cap, per-owner lib and
per-lib item quotas), bind 127.0.0.1 by default (opt in via HOST), and force
credentials off for a wildcard CORS origin. Refactor main() into an exported
buildApp() and add web/backend/test/security.test.ts (inject-based).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

web/backend/vitest.config.ts

@@ -0,0 +1,10 @@
+import { defineConfig } from "vitest/config";
+
+// The reference backend is a Fastify app; tests drive it via app.inject() in a
+// plain node env (no network listen).
+export default defineConfig({
+  test: {
+    environment: "node",
+    include: ["test/**/*.test.ts"],
+  },
+});