fix(agent): reject oversized base64 images before decoding to prevent OOM

[dieutx]

Summary

• _save_anthropic_image_to_temp() calls base64.b64decode(data) with no size check
• A large base64 payload decodes fully into memory before writing to disk
• Fix: check base64 string length before decoding, reject if over 50MB (~37.5MB decoded)

How to reproduce

• Send an inline base64 image > 50MB in a message
• The entire payload is decoded into memory before any write

How to test

• The check is a simple length comparison before the decode call
• Normal images (< 50MB base64) are unaffected

Platform tested

• Linux, hermes-agent v0.4.0

[dieutx]

Closing — #2690 adds comprehensive image size limits (20MB pre-check + post-download) across all image entry points, which covers the OOM prevention this was targeting. The base64 decode path in run_agent.py is a slightly different entry point, but not worth a separate PR given #2690's broader coverage.