Cap paste-import payload at 1 MB (ARCH-05)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend/app/api/v1/endpoints/import_transactions.py

@@ -4,7 +4,7 @@ from datetime import datetime
 from typing import Optional
 
 from fastapi import APIRouter, Depends
-from pydantic import BaseModel
+from pydantic import BaseModel, Field
 from sqlmodel import Session, select
 
 from app.auth import get_current_user
@@ -22,7 +22,8 @@ router = APIRouter(prefix="/import", tags=["import"])
 
 
 class PasteImportRequest(BaseModel):
-    text: str
+    # ~1 MB cap: a full statement paste is a few KB; anything larger is abuse.
+    text: str = Field(max_length=1_000_000)
     bank: Bank = Bank.BAC
     source: TransactionSource = TransactionSource.CREDIT_CARD