readBoundedBytes leaves the body open when Content-Length is over the limit

[rowkav09]

In src/bounded-response.js, readBoundedBytes throws "is too large" as soon as the declared Content-Length is over the limit, before it touches the body. The streamed path cancels its reader on error, but this early exit never cancels response.body, so the connection stays open with an unread body until it is garbage collected or the caller's timer fires. Callers are artwork fetch, hosted devices and uploader, MusicBrainz lookup and provider sign-in.

Repro (repo root):

import { readBoundedBytes } from './src/bounded-response.js'
let cancelled = false
const body = new ReadableStream({ pull(c) { c.enqueue(new Uint8Array(10)) }, cancel() { cancelled = true } })
const r = new Response(body, { headers: { 'content-length': '999999' } })
await readBoundedBytes(r, 1000).catch(() => {})
console.log(cancelled) // false

Expected: true. Same as the streaming path, which cancels on overflow.

Fix: await body?.cancel?.().catch(() => {}) before the throw, plus the test above in test/bounded-response.test.js.

Priority: Low.