Enforce core analysis input limits

[melonamin]

Summary

• enforce a 10 MiB UTF-8 byte limit per raw source and a 100 MiB aggregate request limit before schema, templating, or parser work
• return structured INVALID_REQUEST issues with source attribution
• expose the limits through the schema, generated TypeScript API, core spec, and changelog

Validation

• controlled Codex review: no actionable findings
• cargo test -p flowscope-core
• cargo test -p flowscope-core --no-default-features --lib
• schema guard and generated TypeScript checks
• mise exec yarn@1.22.19 -- just check

[codecov]

Codecov Report

❌ Patch coverage is 93.75000% with 7 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/flowscope-core/src/analyzer/input.rs	93.33%	7 Missing ⚠️

📢 Thoughts on this report? Let us know!