Edge-case audit on PR #26631 caught two real exposures:
1. DoS amplification: Effect's Issue formatter recursively dumps the
rejected `actual` value with no truncation. A 5K-element invalid
array produced a 358 KB 400 response. Cap to 1 KB.
2. Secret echo: a token mis-posted to a typed endpoint (e.g.
`{aggregate:"sk-..."}`) was mirrored verbatim in `data.message` AND
in the warn log. Same cap mitigates — the field path is preserved,
the rejected value is truncated.
Adds two regression tests:
- Query rejection (was uncovered; reachable in production)
- 50 KB invalid payload → response body stays < 2 KB
Kit Langton
7df8cd1de7