Cap `Content-Length` at `HTTP_POST_MAX_BODY` (10 MiB) and size the allocation to the actual body length (`content_length + 1` for the trailing NUL). Also fix `WS_BLOCK` units — `kws_raw_read` takes ms, set to 10000.