Hardening: cap the invite_user list size in UpdateQuestionInviteUser to bound notification fan-out #1617

Background

PUT /answer/api/v1/question/invite accepts an uncapped invite_user array (internal/schema/question_schema.go:206), so a single request can trigger a large number of "invited you to answer" notifications.

I reported this privately to the ASF security team. They confirmed the endpoint's rank-gated, site-wide behaviour is by design (not a boundary crossing), but noted the missing maximum on invite_user reads as hardening. Filing here per that suggestion.

Suggested hardening

• Add a sane server-side maximum on invite_user (e.g. matching the UI's limit) to bound the notification fan-out.

Happy to send a PR.