Summary

• reject browser-originated requests by default unless explicitly allowlisted
• enforce blackd request body limits via aiohttp and gate executor submissions before they enter the process pool
• document the new blackd options and add regression coverage for CORS, body limits, and executor backpressure

Testing

• ./.venv/bin/python -m pytest tests/test_blackd.py