fix: bound airdrop recipient uploads

[jamilahmadzai]

Summary

• cap in-memory recipient CSV uploads with the configurable AIRDROP_CSV_MAX_BYTES limit (5 MiB by default) and return a structured 413
• parse buffered CSV data through 64 KiB chunks and destroy the pipeline as soon as row 10,001 is observed
• rate limit airdrop creation and recipient additions with separate Redis-backed per-IP buckets
• set and document an intentional 2 MiB JSON body limit for legitimate inline payloads up to 10,000 recipients
• cover file-size, streaming row-count, JSON payload, configuration, and both rate-limit paths

Security impact

Previously, Multer buffered unbounded files and the CSV parser materialized every valid row before checking the recipient cap. The mutation routes also had no throttling. This change bounds both input size and accumulated rows before service writes occur, while preserving the existing fail-open Redis limiter policy.

Validation

• npm test -- --runInBand (22 suites, 189 tests)
• node --check on every changed source file
• git diff --check

Closes #85

Bounty: GrantFox OSS campaign for issue #85