fix: add payload size limits to task lane save endpoint

- Max 50 questions, 50 actions, 100 responses (Pydantic max_length)
- Max 256KB total serialized payload (prevents DB bloat)
- Existing guards: JWT auth, role check, ownership check, rate limit

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/app/schemas/ai_session.py

@@ -289,10 +289,11 @@ class ChatMessageResponse(BaseModel):
 
 class SaveTaskLaneRequest(BaseModel):
     """Save the full task lane state (AI items + user responses)."""
-    questions: list[QuestionItem] = []
-    actions: list[ActionItem] = []
+    questions: list[QuestionItem] = Field(default_factory=list, max_length=50)
+    actions: list[ActionItem] = Field(default_factory=list, max_length=50)
     responses: list[dict[str, Any]] = Field(
         default_factory=list,
+        max_length=100,
         description="User's in-progress task responses with state/value",
     )