fix(registration): bound submitted text fields

[gouveags]

Summary

• cap all previously unbounded registration text fields before external API or database work
• keep the limits in one reusable helper
• cover exact-boundary and over-limit cases for every field

Problem

Several public multipart fields had no server-side length ceiling, allowing oversized values to consume resources and flow into later processing.

Validation

• npm run lint -- --quiet
• npx tsc --noEmit
• npm run test:tournaments
• npx prisma validate
• focused boundary probe for all added limits

[gouveags]

@greptileai review

[gouveags]

Independent security review

Current state/checks: OPEN; Validar aplicação passed and the PR-only AWS publish job is skipped. No unresolved review threads were present.

Findings: No blocking issue found. The new limits cover the previously unbounded FACEIT URL, representative email/phone, and discovery-source fields before the FACEIT request or database work; the remaining submitted text is either already bounded, constant-compared, or covered by the request-size ceiling. Exact-boundary and over-limit tests exercise every new field.

Residual/informational: Character counts are post-normalization JavaScript string lengths, which is appropriate for resource bounding but is not a byte-size guarantee; the existing 22 MiB request cap remains the byte-level control. When #11 is integrated, retain this guard before its added ownership-verification API call.

[gouveags]

Addressed the integration review in 7439888: merged current main without rewriting history, preserved both active-claim handling and the pre-external-call text limits, and resolved the shared security-test coverage. Fresh local validation passed: npm run check, npm run build, npx prisma validate, and git diff --check. CI is rerunning on the reconciled head.