fix: port mailbox validation from im server

internal/httpapi/api.go

@@ -25,6 +25,11 @@ type API struct {
 
 const workbenchEventPublishTimeout = 15 * time.Second
 
+const (
+	maxMailboxSubjectLength = 200
+	maxMailboxContentLength = 5000
+)
+
 func New(st *store.Store, authenticator *auth.Authenticator, publisher events.Publisher) *API {
 	if publisher == nil {
 		publisher = events.NoopPublisher{}
@@ -879,9 +884,14 @@ func (a *API) mailboxSubmissions(w http.ResponseWriter, r *http.Request, p *auth
 	if !decodeBody(w, r, &body) {
 		return
 	}
+	subject := strings.TrimSpace(body.Subject)
+	content := strings.TrimSpace(body.Content)
+	if ok := validateMailboxSubmission(w, r, subject, content); !ok {
+		return
+	}
 	attachments, _ := json.Marshal(body.AttachmentFileIDs)
 	submission, err := a.store.CreateMailboxSubmission(r.Context(), p.UserID, store.MailboxSubmission{
-		SubmissionID: "mb_" + randomToken(12), Subject: strings.TrimSpace(body.Subject), Content: strings.TrimSpace(body.Content),
+		SubmissionID: "mb_" + randomToken(12), Subject: subject, Content: content,
 		Anonymous: body.Anonymous, AttachmentFileIDs: string(attachments), NoticeVersion: strings.TrimSpace(body.NoticeVersion),
 	}, idempotencyKey)
 	if err != nil {
@@ -896,6 +906,18 @@ func (a *API) mailboxSubmissions(w http.ResponseWriter, r *http.Request, p *auth
 	writeSuccess(w, r, mailboxSubmissionPayload(*submission))
 }
 
+func validateMailboxSubmission(w http.ResponseWriter, r *http.Request, subject, content string) bool {
+	if len([]rune(subject)) > maxMailboxSubjectLength {
+		writeError(w, r, http.StatusBadRequest, 30000, reasonValidationFailed, "validation failed", map[string]any{"field": "subject", "max_length": maxMailboxSubjectLength})
+		return false
+	}
+	if len([]rune(content)) > maxMailboxContentLength {
+		writeError(w, r, http.StatusBadRequest, 30000, reasonValidationFailed, "validation failed", map[string]any{"field": "content", "max_length": maxMailboxContentLength})
+		return false
+	}
+	return true
+}
+
 func (a *API) publishWorkbenchEvent(w http.ResponseWriter, r *http.Request, p *auth.Principal, module, action, resourceID string, targets []int64, title, summary string, data map[string]any) bool {
 	if a.events == nil {
 		return true