Harden bot submission: RESULT size cap, NSE_HASHES limits, atomic file write

[t0kubetsu]

Summary

Fixes #141. Two critical issues in /bot_api/sndjob.

Changes

1. Unbounded RESULT payload (DoS/disk exhaustion)

RESULT had no validate=Length(max=...). Flask had no MAX_CONTENT_LENGTH. A single authenticated agent could submit a multi-GB JSON string.

• Added validate.Length(max=50 * 1024 * 1024) to RESULT
• Added validate.Length(max=50) and per-key/value length limits to NSE_HASHES
• Added MAX_CONTENT_LENGTH = 64 * 1024 * 1024 to config.py.template

2. Job marked finished before file write (data loss)

job_bot.finished = True was set before open(base, "w"). Any write failure (disk full, malformed JSON, OSError) left the job permanently marked finished with no data file. The idempotent resubmit guard then returned 200 on agent retry without re-writing — scan results permanently lost.

Fix: write the file first; only mutate ORM state after the write succeeds. Wrap the write in try/except (OSError, json.JSONDecodeError) with db.session.rollback() on failure.

Test plan

• Submit a RESULT payload larger than 50 MB — verify 400 validation error
• Submit with more than 50 NSE_HASHES entries — verify 400 validation error
• Simulate an OSError during file write — verify job is NOT marked finished
• Normal submission — verify job is marked finished and file exists