fix(bluebubbles): bound REST JSON responses

[ooiuuii]

Fixes #55274

Summary

• Switch BlueBubbles REST JSON helpers from buffered get() / post() calls to client.stream(...).
• Add a 16 MiB cap while reading JSON response bytes and close the stream immediately when the cap is exceeded.
• Apply the same bounded JSON reader to the attachment-upload response body.
• Update BlueBubbles tests with stream-aware fakes and coverage for normal JSON reads, oversized stream closure, and attachment-upload response parsing.

Scope

This intentionally does not change inbound attachment downloads. That is a separate media/cache-helper boundary and overlaps historical work such as #35297 / #42931.

Validation

• C:\Users\Administrator\Documents\Codex\2026-06-29\hermes-main-latest-scan\.venv\Scripts\python.exe -m pytest tests\gateway\test_bluebubbles.py -q --basetemp .pytest-tmp-bluebubbles-response-cap-venv → 59 passed
• C:\Users\Administrator\Documents\Codex\2026-06-29\hermes-main-latest-scan\.venv\Scripts\python.exe -m ruff check gateway\platforms\bluebubbles.py tests\gateway\test_bluebubbles.py → All checks passed
• git diff --check

[tonydwb]

Code Review Summary

Verdict: LGTM

Good security fix. Replaces buffered REST JSON helpers with streaming reads and adds a 16 MiB body cap for BlueBubbles API responses. Prevents memory exhaustion from oversized upstream responses.

• Clean streaming pattern with size enforcement
• Consistent with similar bounding PRs in the batch
• Well-scoped: 2 files, 180 additions

Reviewed 2 files, 180 additions. Approved.

[alt-glitch]

This was generated by AI during triage.

Fix PR for #55274 (issue<->fix pair, same author) — linking as related, not duplicate. Same bounded-REST-JSON hardening class as your Mattermost (#54754) and Discord standalone-send (#55209) PRs.

[teknium1]

Thanks for the focused BlueBubbles hardening. The premise remains present on current main: _api_get and _api_post buffer REST responses before JSON parsing at gateway/platforms/bluebubbles.py:225 and gateway/platforms/bluebubbles.py:231; attachment upload has the same pattern at gateway/platforms/bluebubbles.py:595.

The PR's streamed, byte-capped JSON reader directly addresses those JSON-consuming paths and includes coverage for normal streaming, the oversize path, and attachment-upload parsing. No blocking correctness issue was identified from the diff and current-main inspection. Current main has moved only in adjacent BlueBubbles webhook and GUID-resolution work, so this appears suitable for mechanical cherry-pick/salvage rather than reimplementation.

Automated hermes-sweeper review.