fix(ownership): sync snapshots over 10 MiB; refuse oversized publishes

On 2026-09-25 a snapshot built with --history 5 (15.3 MB) was
published, and `idx ownership sync` failed for every client:
"the response body is larger than request limit: 10485760" (ureq's
default body cap). It was republished by hand with --history 2 (8.2 MB).

- snapshot download: raise the ureq body limit to 1 GiB; the file is
  still verified against the manifest's size and SHA-256. The PDF/XLSX
  report downloads get a 256 MiB limit for the same reason.
- CLI test: sync a >10 MiB snapshot over HTTP (fails without the fix
  with the exact production error).
- build-latest-ownership-snapshot.sh: --max-snapshot-bytes (default
  10485760, the limit of released clients <= v0.2.3); an oversized
  snapshot fails the build, so the published one stays untouched.
- publish-ownership-snapshot.sh passes --max-snapshot-bytes through;
  publisher tests cover the failure and that the release is unchanged.
- docs: size table and guidance.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017a5Cv5Z1NzdYKgKnTiAF4E

docs/OWNERSHIP_SELF_HOSTED.md

@@ -103,6 +103,25 @@ idempotent run the exact day no longer matters.
 Pass `--history <n>` to include earlier months so `idx ownership changes`
 works straight from the synced snapshot (about 2.4 MB per extra month).
 
+### Snapshot size limit
+
+idx clients up to v0.2.3 cap the snapshot download at **10 MiB** (10,485,760
+bytes) and only accept uncompressed SQLite. A larger snapshot makes
+`idx ownership sync` fail for every existing install. This happened on
+2026-09-25 with `--history 5` (15.3 MB).
+
+| `--history` | months | size (2026-08-31) |
+| --- | --- | --- |
+| 2 | 3 | 8,171,520 |
+| 3 | 4 | 10,510,336 (too large) |
+| 5 | 6 | 15,290,368 (too large) |
+
+The builder therefore refuses snapshots above `--max-snapshot-bytes`
+(default 10485760). The run ends `RESULT: FAILED stage=build-snapshot` and the
+published snapshot stays unchanged. Newer clients stream downloads up to 1 GiB;
+raise `--max-snapshot-bytes` and `--history` only after clients without the
+10 MiB cap are widespread.
+
 ## Clan Integration Later
 
 The clean split for `clan-private` is: