fix: inline step secrets + inline input/output display + import body limit

server/internal/api/workflows.go

@@ -212,7 +212,10 @@ func seedDefaults(c *gin.Context) {
 	c.JSON(http.StatusOK, gin.H{"created": created, "updated": updated})
 }
 
+const maxStepBodyBytes = 1 << 20 // 1 MiB
+
 func importStep(c *gin.Context) {
+	c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, maxStepBodyBytes)
 	body, err := io.ReadAll(c.Request.Body)
 	if err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
@@ -230,6 +233,7 @@ func importStep(c *gin.Context) {
 // parseStep validates a step doc and returns the normalized step WITHOUT
 // persisting — used by the editor to insert an imported ad-hoc (inline) step.
 func parseStep(c *gin.Context) {
+	c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, maxStepBodyBytes)
 	body, err := io.ReadAll(c.Request.Body)
 	if err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})