[JelleZijlstra]

Summary

• reject browser-originated requests by default unless explicitly allowlisted
• enforce blackd request body limits via aiohttp and gate executor submissions before they enter the process pool
• document the new blackd options and add regression coverage for CORS, body limits, and executor backpressure

Testing

• ./.venv/bin/python -m pytest tests/test_blackd.py

[github-actions]

diff-shades results comparing this PR (cd50556) to main (0dae20b):

--preview style: no changes

--stable style: no changes

---

What is this? | Workflow run | diff-shades documentation