fix(axum): enforce mutation request boundaries

req: security/003

docs/recipes/auth-session-csrf.md

@@ -116,6 +116,10 @@ pub struct NewProject {
 
 The browser submits the same form with or without the hemx runtime. Cookies,
 SameSite behavior, and credential inclusion remain browser/framework concerns.
+`hemx_axum::InteractionRequest` accepts only URL-encoded and multipart forms;
+apply Axum's `DefaultBodyLimit` (or a compatible host limit) to every mutation
+route. Media-type and size checks run before dispatch, while CSRF remains the
+explicit application or middleware check shown below. req: security/003
 
 ## Mutation handler