Control: close the connection on input that isn't a request

A line that is not a JSON object with a string `method` (an HTTP request
line, other non-JSON text, a JSON array, invalid UTF-8, a line over 4 MiB)
now gets one error reply and the connection is closed, so a browser's
cross-origin fetch can't smuggle a command in its body. Connections are
capped at 16. Same transport as LightCraft (storytold/lightcraft#129) and
FilmCraft (storytold/filmcraft#123).

docs/control-protocol.md

@@ -14,6 +14,13 @@ effectcraft --control 9877        # or EFFECTCRAFT_CONTROL_PORT=9877
 - Requests run on the UI thread between frames. Input methods (`ui.click`, `ui.key` and similar)
   reply after the synthetic input has been processed. Methods that need an element that isn't drawn
   yet are retried for a few frames. A request times out after 60 s.
+- **Only requests are read:** every line must be a JSON object with a string `method` (blank lines are
+  skipped). Anything else (text that isn't JSON, a JSON array or number, an object without `method`,
+  invalid UTF-8, a line longer than 4 MiB) gets one error reply ending in "closing the connection", and
+  the server closes the connection, so nothing sent after it runs. An HTTP request (for example a web
+  page's cross-origin `fetch` to `127.0.0.1:<port>`) therefore can't smuggle a command in its body: its
+  request line is rejected first. At most 16 connections are served at once; further ones get an error
+  line and are closed. The port has no authentication, so only enable it while you use it.
 
 Quick test: