[Frontend] Validate ZKP generation and verification payload sizes

## Problem

Proof endpoints accept computationally sensitive input and need bounded schemas.

## Relevant code

`src/pages/api/zkp`

## Proposed scope

Limit body size and field complexity, reject malformed proofs early, and add timeout plus abuse tests.

## Acceptance criteria

- [ ] The reported behavior is reproduced or characterized with a focused automated test before the fix.
- [ ] The implementation satisfies the proposed scope without weakening TypeScript, lint, authorization, privacy, or error handling.
- [ ] Success, empty/loading where applicable, failure, and boundary cases are covered.
- [ ] Existing related tests pass and new regression coverage is included.
- [ ] User-facing behavior remains accessible by keyboard and at mobile viewport sizes where UI is affected.
- [ ] Documentation is updated when the change alters configuration, contracts, security assumptions, or contributor workflow.

## Contributor notes

Base the work on the latest `main` branch. Keep unrelated refactors out of the pull request and include screenshots or recordings for visible changes. Never use real pet, medical, contact, wallet, or credential data in fixtures.

Start by inspecting the proof endpoints under src/pages/api/zkp and any existing related tests. Characterize oversized, overly complex, malformed, and slow proof requests first; done means bounded payloads are rejected early, timeout and abuse cases are covered, and the existing related tests still pass.

Written by the indexing model from the issue text.