fix(api): bind daily and synastry charts to stored profiles

Stop accepting client-supplied birth data on those paths, and cap session writes plus location lookups so a logged-in caller cannot farm compute.

Co-authored-by: Cursor <cursoragent@cursor.com>

frontend/tests/chat-session-write.test.ts

@@ -77,6 +77,24 @@ test("owner or validation failures are not retried", async () => {
   assert.equal(attempts, 1);
 });
 
+test("session writes reject oversized transcripts before they reach storage", () => {
+  const oversized = chatSessionWriteSchema.safeParse({
+    ...values,
+    messages: [{ role: "user", text: "字".repeat(16_001) }],
+  });
+  const tooMany = chatSessionWriteSchema.safeParse({
+    ...values,
+    messages: Array.from({ length: 201 }, () => ({ role: "user" as const, text: "你好" })),
+  });
+  const tooMuchText = chatSessionWriteSchema.safeParse({
+    ...values,
+    messages: Array.from({ length: 20 }, () => ({ role: "user" as const, text: "字".repeat(12_000) })),
+  });
+  assert.equal(oversized.success, false);
+  assert.equal(tooMany.success, false);
+  assert.equal(tooMuchText.success, false);
+});
+
 test("session API owns create and update while answer UI keeps sync failures out of reply errors", () => {
   const page = readFileSync(new URL("../src/app/page.tsx", import.meta.url), "utf8");
   const collectionRoute = readFileSync(new URL("../src/app/api/sessions/route.ts", import.meta.url), "utf8");
@@ -87,6 +105,10 @@ test("session API owns create and update while answer UI keeps sync failures out
   assert.match(collectionRoute, /export async function POST/);
   assert.match(itemRoute, /export async function PATCH/);
   assert.match(itemRoute, /\.eq\("user_id", user\.id\)/);
+  assert.match(collectionRoute, /readChatSessionJson/);
+  assert.match(itemRoute, /readChatSessionJson/);
+  assert.match(collectionRoute, /ChatSessionBodyTooLargeError/);
+  assert.match(itemRoute, /ChatSessionBodyTooLargeError/);
 });