security: unbounded gzip/deflate decompression (zip bomb) on ingest #330

Problem

crates/trapfall-ingest/src/envelope.rs:191-202 decompresses gzip/deflate with read_to_end and no output cap. max_ingest_body_bytes only limits the compressed body. DSN keys are semi-public in client apps.

Scenario

A ~1 MB gzip expands to ~1 GB, OOM-kills the process; with panic=abort it dies immediately.

Fix

• Wrap decoder in Read::take(MAX_DECOMPRESSED + 1), error if exceeded.
• Cap attachment count/size.
• Avoid data.len() * 2 pre-allocation.
• Use checked_add for pos + length (envelope.rs ~96/116); a wrapped bounds check can panic on slice and abort.
• Match Content-Encoding case-insensitively.

Found in static audit of develop @ db3ca67.