docs(api): approve request size limits

docs/API-SPEC.md

@@ -225,8 +225,8 @@ Approved existing limits remain unchanged:
 
 API boundary limits:
 
-- Proposed: JSON request body is limited to 16 KiB; requests with no defined body reject non-empty bodies.
-- Proposed: request target/query string is limited to 8 KiB at the public edge.
+- Approved: JSON request bodies are limited to 16 KiB; requests with no defined body reject non-empty bodies.
+- Approved: the request target/query string is limited to 8 KiB at the public edge.
 - Approved: detail pages default to 25 rows and cannot exceed 100.
 - Approved: synchronous CSV export is limited to 100,000 rows, 50 MiB estimated uncompressed output, and 60 seconds, with 3 requests/10 minutes and burst 1 per user and merchant.
 
@@ -278,10 +278,11 @@ Correlate `requestId`, authenticated user/merchant internal ids, run id, section
 - Analytics-access and CSV-export audit records are retained for 90 days and are accessible only to explicitly authorized backend operators; the MVP exposes no merchant audit-history surface.
 - Detail responses and CSV exports show the existing opaque source terminal reference as `شناسه پایانه`; it is tenant-scoped trace data and never an authorization input.
 - RFC 9457 problem `type` URIs use `https://zarinpal.amiirkhl.ir/docs/errors/{error-slug}` and resolve to human-readable error documentation.
+- Public-edge requests are limited to 16 KiB for JSON bodies and 8 KiB for the request target/query string.
 
 ## Remaining product questions
 
-1. Approve or revise the proposed public-edge request limits: 16 KiB for JSON bodies and 8 KiB for the request target/query string.
+None. Final approval of this complete capability spec and its OpenAPI contract remains the SDD gate before implementation planning.
 
 ## Standards references