harden(p4/export): AVA 网关超时·限流·历史上限 + 导出图元数上限(#644/#645 fast-follow)

两个已合 PR(#644 房间 AVA 网关、#645 headless 导出)经安全 review 均 **Accept**(🔴 无、SSRF 不存在、越权/注入/错误脱敏均达标),但各有 🟡 加固项作 fast-follow。

## #644 房间 AVA 网关(`packages/data/src/roomChat.ts`)
- 🟡 **付费调用无超时/限流**:`generateRoomChatReply`(~L331-350)每次创建者 POST 触发真实 `runChatGraph`,无 `AbortController`/超时、无 per-user/room 限流。接真实网关后是成本面(虽限于创建者自有线程,仍无界)。加超时 + 简单限流。
- 🟡 **喂网关的历史无上限**:`sendRoomChatMessage`(~L367)`listRoomChatMessages` 取全量历史进 `messages[]`,线程越长 prompt/成本无界。截断最近 N 条。
- 🟡 **progress/handoff 空模板**:`phases/phase-p4-room-chat/sprints/sprint-02/{progress,session-handoff}.md` 是未填占位(``)。补真实收尾记录(AGENTS.md 干净收尾要求)。

## #645 headless 导出(`apps/web/app/api/boards/[id]/export/route.ts`)
- 🟡 **导出图元数无上限**:`listBoardItems` 无项数/产物体积软上限,超大白板 CPU/内存无界。加软上限 + 并发限制。文本已在渲染层截断(SVG 120/PDF 80 字符),仅项数未限。
- 🟢 GET 无 try/catch(生产不泄栈可接受):可加 try/catch + `console.error` 与 #644 对齐。

均为加固,非安全阻断。

Start with packages/data/src/roomChat.ts at generateRoomChatReply and sendRoomChatMessage, then inspect phases/phase-p4-room-chat/sprints/sprint-02/progress.md and session-handoff.md. Review apps/web/app/api/boards/[id]/export/route.ts and its listBoardItems call. Done means gateway calls have timeout and simple limits, history and exports have soft caps, concurrency is bounded, and the sprint records are complete.

Written by the indexing model from the issue text.