fix: cap room.comments at 200 entries per collaboration session

[rachel-d-07]

Fixes #1128 - room.comments was unbounded, allowing a single client to flood the list indefinitely and cause unbounded memory growth. Each new comment also broadcasts the full list to all connected clients, so payload size grew linearly with no limit.

Added MAX_COMMENTS_PER_ROOM = 200 constant and a guard at the top of _handle_comment_added() that rejects further comments with an error response once the cap is reached.

Description

In backend/app/routers/collaboration.py, the CollaborationRoom
dataclass held an unbounded comments list. Every comment_added
message appended to it and then broadcast the full list to all
connected WebSocket clients — meaning payload size grew linearly with
no upper limit. A single malicious or misbehaving client could flood
the list indefinitely, consuming unbounded server memory and
increasingly large broadcast payloads.

Fix: added MAX_COMMENTS_PER_ROOM = 200 alongside the existing
MAX_CODE_CHARS and MAX_COMMENT_CHARS constants, and added a guard
at the top of _handle_comment_added() that rejects further comments
with a clear error response once the cap is reached. No other logic
is affected.

Related Issue

Fixes #1128

Type of change

• Bug fix

Checklist

• I have read CONTRIBUTING.md
• My branch is up to date with main
• I have run pytest -v and all tests pass
• I have not introduced duplicate issues or features
• My PR title follows the format: feat/fix/docs/test: short description
• I have added tests for new features (Level 2 and 3 issues)
• No hardcoded secrets or API keys in my code
• This PR is linked to a GSSoC 2026 issue

Screenshots (if frontend change)

Test evidence

Local environment does not have all backend dependencies configured
for a full pytest run. Fix verified by code inspection and import check:

• Guard runs before async with room.lock so no lock is acquired
  on rejected requests — no performance cost for the rejection path
• Uses >= comparison so the cap is enforced at exactly 200, not 201
• Error response matches the existing error format used throughout
  the file ({"type": "error", "detail": "..."})
• MAX_COMMENTS_PER_ROOM placed alongside MAX_CODE_CHARS and
  MAX_COMMENT_CHARS for consistency and easy future tuning

python -c "from app.routers.collaboration import MAX_COMMENTS_PER_ROOM; print(MAX_COMMENTS_PER_ROOM)"
# 200