Harden backup and restore operations

internal/api/server.go

@@ -301,6 +301,10 @@ func decode(r *http.Request, target any) error {
 	if err := decoder.Decode(target); err != nil {
 		return fmt.Errorf("validation: invalid JSON: %w", err)
 	}
+	var trailing any
+	if err := decoder.Decode(&trailing); !errors.Is(err, io.EOF) {
+		return errors.New("validation: JSON body must contain exactly one value and be at most 2 MiB")
+	}
 	return nil
 }