fix(http): 400 on malformed JSON body instead of 500

express.json() raising a parse error was falling through to the generic
500 handler, which reads as a server fault for what is a bad request.
Also maps the body-size limit to 413.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

PLAN.md

@@ -140,10 +140,20 @@ Both are revocable, expiring, and logged.
       72 assertions covering auth, RBAC, VNC auth, view-only, invites, agent tunnel
 
 ### Phase 7 — Front end polish
-- [~] Modern visual design pass across all five pages
-- [~] Particle background (network-of-machines motif), reduced-motion aware,
+- [x] Modern visual design pass across all five pages
+- [x] Particle background (network-of-machines motif), reduced-motion aware,
       never rendered behind a live VNC canvas
 
+### Deployed
+Live at `http://192.168.4.212:5910` (Swarm ingress). Published port is 5910, not
+8091 — 8091 is reserved on the ingress by `ai-training-lab_ai-lab`, and that
+reservation holds even while nothing answers on it, so probing the port cannot
+tell you it is taken. Only the Swarm's own view is authoritative.
+
+Remaining to be usable from outside the LAN console:
+- [ ] `support.freakma.com` DNS + Nginx Proxy Manager host, **WebSocket support on**
+- [ ] First machine enrolled
+
 ### Phase 8 — Later / nice to have
 - [ ] File transfer between operator and client
 - [ ] Clipboard sync toggle per session