feat: nightly hardening - streamed response size guard

[mouse-value-add]

Problem

loadFromUrl only rejected oversized remote profiles early when content-length was present. If a server omitted or lied about content-length, we read the entire response via response.text() before size checks, which could cause unnecessary memory pressure.

Approach

• Added streamed response reading with byte accounting in YouMdParserImpl.
• Enforced maxFileSize while consuming chunks and cancel the reader as soon as the limit is exceeded.
• Preserved existing behavior for content-length pre-check and timeout handling.
• Mapped streamed over-limit failures to FILE_TOO_LARGE.
• Added a test for oversized streamed responses without content-length.

Verification

• Ran npm test (17 files, 142 tests passing).
• Confirmed new test coverage in test/parser/loadFromUrl.test.ts for no-content-length oversized stream.

Risks

• Stream handling path is new and could behave differently in runtimes with non-standard fetch/body implementations.
• Slightly more code complexity in the URL loading path.

Rollback plan

• Revert commit f198c69 to restore prior response.text() behavior.
• If needed, keep only content-length pre-check while investigating runtime-specific stream behavior.