feat: harden workspace file APIs

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

cmd/server/main.go

@@ -2,7 +2,7 @@ package main
 
 import (
 	"context"
-	"log"
+	"log/slog"
 	"net/http"
 	"os"
 	"os/signal"
@@ -18,21 +18,25 @@ import (
 )
 
 func main() {
+	startupLogger := slog.New(slog.NewJSONHandler(os.Stderr, nil))
+
 	cfg, err := config.Load("configs/config.yaml")
 	if err != nil {
-		log.Fatalf("failed to load config: %v", err)
+		startupLogger.Error("failed to load config", "error", err)
+		os.Exit(1)
 	}
 
 	lg, err := logger.New(cfg.Log)
 	if err != nil {
-		log.Fatalf("failed to initialize logger: %v", err)
+		startupLogger.Error("failed to initialize logger", "error", err)
+		os.Exit(1)
 	}
 
 	workspaces := workspace.NewLocalManager(cfg.Workspace.Root)
 	processes := process.NewManager(cfg.Process.OpenCodeCommand)
 
 	workspaceSvc := service.NewWorkspaceService(workspaces, processes, lg)
-	fileSvc := service.NewFileService(workspaces)
+	fileSvc := service.NewFileService(workspaces, cfg.File.MaxWriteBytes)
 	processSvc := service.NewProcessService(workspaces, processes, lg)
 
 	router := api.NewRouter(workspaceSvc, fileSvc, processSvc, lg)
@@ -48,7 +52,6 @@ func main() {
 
 	lg.Info("server starting",
 		"addr", cfg.Server.Addr,
-		"workspace_root", cfg.Workspace.Root,
 		"read_timeout", cfg.Server.ReadTimeout.String(),
 		"write_timeout", cfg.Server.WriteTimeout.String(),
 		"idle_timeout", cfg.Server.IdleTimeout.String(),