fix(backend): API 文本输入加 max_length + 请求体大小中间件（CR-H9）

apps/api/ww_api/schemas/foreshadow.py

@@ -11,12 +11,18 @@ from typing import Any
 
 from pydantic import BaseModel, Field
 
+# 请求字符串字段长度上界（CR-H9：防超长入参 DoS/成本）。代号=短标识；标题=一句话。
+_CODE_MAX = 100
+_TITLE_MAX = 500
+
 
 class ForeshadowRegisterRequest(BaseModel):
     """POST /projects/:id/foreshadow：作者显式登记一条伏笔（status 落 OPEN）。"""
 
-    code: str = Field(min_length=1, description="伏笔代号，`(project_id, code)` 唯一")
-    title: str = Field(min_length=1, description="伏笔标题/一句话描述")
+    code: str = Field(
+        min_length=1, max_length=_CODE_MAX, description="伏笔代号，`(project_id, code)` 唯一"
+    )
+    title: str = Field(min_length=1, max_length=_TITLE_MAX, description="伏笔标题/一句话描述")
     planted_at: int | None = Field(default=None, description="埋设章号")
     content: str | None = Field(default=None, description="伏笔正文/线索")
     expected_close_from: int | None = Field(default=None, description="预期回收窗口起始章")