fix(core,protocol): simplify store_protocol and add download size cap

- store_protocol: always write to shared Arc<Mutex<Option<ProtocolClient>>>;
  the FileTransferService holds the same Arc so it sees updates automatically
- read_download_bytes: reject downloads exceeding 10 MB to prevent
  malicious servers from causing OOM

core/chanora_core/src/lib.rs

@@ -285,12 +285,10 @@ impl ChanoraSession {
     }
 
     async fn store_protocol(&self, client: Option<chanora_protocol::ProtocolClient>) {
-        let service = { self.file_transfer.lock().await.clone() };
-        if let Some(service) = service {
-            service.set_protocol(client).await;
-        } else {
-            *self.protocol.lock().await = client;
-        }
+        // Always update the shared Arc. The FileTransferService holds
+        // the same Arc, so it sees the new client automatically — no
+        // separate set_protocol call needed.
+        *self.protocol.lock().await = client;
     }
 
     async fn take_protocol(&self) -> Option<chanora_protocol::ProtocolClient> {