http_api: bump httpd stack to 8 KiB — POST /config was overflowing

POST /config has ~2.4 KiB of stack locals (2 KiB body buffer + the
scrypted URL + viewport name + cJSON parser frames) which overran the
default 4 KiB httpd task stack and tripped the stack-protect canary
mid-handler. The request body was applied to RAM + NVS, but the
handler crashed before sending the response, so curl saw a connection
reset and the device rebooted into "Stack protection fault".

M4 + M6 ✅ verified 2026-06-14 after the bump:
  - POST /config full / partial → 204; survives reboot via NVS
  - 5 validation failure modes → 400
  - POST /state wake/sleep → 204; idempotent repeats → 204
  - POST /frame while asleep → 409 with expected body
  - idle timer fires after idle_timeout_ms; 0 correctly disables

1 files changed, 5 insertions, 0 deletions

diff --git a/main/http_api.c b/main/http_api.c
index b3378b5..5b5769a 100644
--- a/main/http_api.c
+++ b/main/http_api.c
@@ -451,6 +451,11 @@ esp_err_t http_api_start(void)
     cfg.server_port      = 80;
     cfg.max_uri_handlers = 8;
     cfg.lru_purge_enable = true;
+    // Default 4 KiB is tight: /config alone has ~2.4 KiB of stack locals
+    // (2 KiB body buffer + 256 B scrypted URL + 64 B name + cJSON frames)
+    // and POST /frame pushes a JPEG header onto the stack too. 8 KiB gives
+    // both handlers comfortable headroom without doubling RAM usage.
+    cfg.stack_size       = 8192;
 
     httpd_handle_t server = NULL;
     ESP_RETURN_ON_ERROR(httpd_start(&server, &cfg), TAG, "httpd_start");