How to restrict HTTP/HTTPS transfer-size for clients of a Linux router?

I have a shared environment which runs WIFI on a mini-PC running Linux. Currently this box runs straight NAT with iptables. My goal is to restrict all HTTPS downloads to less than an arbitrary amount, such as 5MB. The intent is to prevent all large file downloads. I'd like normal web browsing to remain efficient, so constant bandwidth limits are not viable. Ideally I'd like to be able to set a smaller limit on uploads, and get a log of the attempted download site (eg, from SSL SNI). I do not have control over the client device, so I recognize I can't practically decrypt the traffic. What I've

Question by AlasAlice on Super User, licensed CC BY-SA. We show a short excerpt and link to the original thread as credit.