feat(BA-7345): limit the size of an app config fragment

[jopemachine]

Resolves #13730 (BA-7345)

Summary

• Cap one app config fragment at 64 KiB of compact JSON (MAX_APP_CONFIG_FRAGMENT_BYTES), checked in AppConfigFragmentService.bulk_upsert before the batch reaches the repository, so the GraphQL and the REST v2 write paths are both covered. Nothing bounded the document until now — the DTO accepted any dict and the JSONB column stopped only at Postgres' field ceiling.
• Reject an oversize document with a new AppConfigFragmentTooLarge error under a new ErrorDomain.APP_CONFIG_FRAGMENT. One oversize item rejects the whole batch, as the allow-list write gate already does.
• State the limit in the upsert input's field description, on the v2 DTO and on the GraphQL input.

The value is arbitrary for this PR. BA-7345 keeps the open questions: the number itself, whether it belongs in the manager config or per config name on the definition / allow-list entry, whether the merged result of all fragments for one config name needs its own cap, and whether the per-request item count should be bounded too.

Test plan

• Unit tests for the service: a document exactly at the limit is written, and a batch holding one oversize item is rejected without reaching the repository
• CI green — the suite was not exercised locally

🤖 Generated with Claude Code

[jopemachine]

Temp value FYI