fix(net): cap market and bootstrap HTTP response bodies

Several HTTP fetches read a remote body into memory without a tight
bound. The price and exchange-ticker calls shared one large 16 MiB
metadata cap, and the bootstrap checksum download had no size limit at
all, so a hostile or MITM'd server streaming an unbounded (and
Content-Length-free) response could grow memory far past anything these
endpoints legitimately return.

- The HTTP GET helper now takes a per-call byte cap and redirect limit.
  The write callback refuses bytes past the cap, which aborts the
  transfer, and the same value is set as curl's max file size.
- The price call is capped at 256 KiB and the ticker list at 2 MiB,
  each sized to its real payload rather than the shared default.
- The bootstrap checksum fetch caps its body at 64 KiB in both the
  write callback and curl's max file size.

Tests cover the sink accept/abort boundary.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/util/bootstrap.cpp

@@ -868,6 +868,7 @@ bool Bootstrap::cleanChainData(const std::string& dataDir) {
 static size_t writeStringCallback(void* contents, size_t size, size_t nmemb, void* userp) {
     size_t total = size * nmemb;
     auto* str = static_cast<std::string*>(userp);
+    if (str->size() + total > (64u * 1024)) return 0;   // refuse an oversized checksum file -> curl aborts
     str->append(static_cast<const char*>(contents), total);
     return total;
 }
@@ -881,6 +882,7 @@ std::string Bootstrap::downloadSmallFile(const std::string& url) {
     curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, writeStringCallback);
     curl_easy_setopt(curl, CURLOPT_WRITEDATA, &result);
     curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
+    curl_easy_setopt(curl, CURLOPT_MAXFILESIZE_LARGE, static_cast<curl_off_t>(64 * 1024));
     curl_easy_setopt(curl, CURLOPT_USERAGENT, "ObsidianDragon/1.0");
     curl_easy_setopt(curl, CURLOPT_TIMEOUT, 30L);
     curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, 15L);