cli/api: honor caller Content-Type and error on oversize bodies

Address PR review + a trail finding on entire api:

• do() now defaults a body's Content-Type to application/json only when the caller didn't set one, so entire api -H 'Content-Type: …' can POST a non-JSON --input body (was unconditionally clobbered). Fixes trail finding 019f2341 / Copilot.
• readWithinLimit reads up to the cap + errors when the source exceeds it, instead of silently truncating — both the response body and stdin --input now fail loudly rather than printing/sending malformed JSON.