bmersereau caps the bulk download before it bites back

The bulk-download endpoint on this fork now refuses any request that asks for more than a fixed number of documents in one go, returning an error instead of trying to load them all into memory at once. Before the change, an authenticated user could ask the server to bundle an arbitrary pile of large files into a single archive - a quiet but real way to exhaust resources.

The fix is deliberately small. Rather than re-engineering how archives are built or streamed, @bmersereau picks a hard ceiling and rejects anything above it. It trades some flexibility for a guarantee that's easy to audit and easy for the next reviewer to reason about. A small test suite gets wired up alongside it so the limit can't quietly disappear later.