[transports-graphql] Validate maxBodySizeBytes as a finite positive transport limit

[kang-heewon]

Priority: P1

Problem

GraphQL transport accepts maxBodySizeBytes without validation. Negative values reject ordinary requests, Infinity removes the protection, and NaN defeats the byte comparison.

Evidence

packages/transports-graphql/src/libs/types.ts:15-23 exposes the option and GraphQLServer.ts:180-211 uses it in body-size comparisons with no validation boundary.

Desired outcome

Request-size protection has one explicit, safe configuration contract.

Implementation path

1. Validate a finite positive safe integer during server initialization.
2. Return a typed configuration Problem with a stable code.
3. Test negative, zero, NaN, Infinity, fractional, and valid limits.

Acceptance criteria

• Invalid limits fail before the listener accepts requests.
• Valid limits enforce the documented byte boundary.
• Regression tests cover both buffered and streamed body paths.

Validation

pnpm --filter @croco/transports-graphql test

Scope boundaries

Does not alter GraphQL query-depth or complexity limits.