fix(web,gateway): close P3 re-review#3 findings — sanitize command errors, harden turn-lock & caps

apps/web/src/spa/chat/limits.ts

@@ -16,3 +16,7 @@ export const MAX_COMMAND_RESULTS = 200;
 export const MAX_MANIFEST_ITEMS = 500;
 /** Max executed approval IDs remembered for single-flight dedup. */
 export const MAX_EXECUTED_APPROVAL_IDS = 200;
+/** Max characters retained for a single command:result message — a hostile
+ * or malfunctioning gateway must not be able to push an unbounded curated
+ * success/failure reason into state (or, defensively, onto the page). */
+export const MAX_COMMAND_MESSAGE_CHARS = 1_000;