fix: contact length limits + logger/next.config nitpicks + dep updates

- /api/contact enforces per-field length caps (name/email/subject/message)
  before sanitization/persistence; over-long message returns 400 without
  touching Mongo (test added)
- logger: crypto-based request id (randomUUID) instead of Math.random().substr;
  defaultMeta.version prefers DEPLOY_VERSION over npm_package_version
- next.config: move Turbopack svg rule from deprecated experimental.turbo to
  top-level turbopack
- deps: bump next 15.5.2 → 15.5.23; npm audit fix (19 → 3, remaining are
  transitive sharp/libvips DoS advisories, not exploitable for static images)

Closes MITHOME-78, MITHOME-79

proto/src/app/api/contact/route.ts

@@ -50,6 +50,23 @@ function sanitizeInput(input: string): string {
   return input.trim().replace(/[<>]/g, '')
 }
 
+// WHY: explicit length caps — the CMS has a body limit but this public endpoint
+// does not; without them an arbitrarily large message could be written to Mongo.
+const MAX_LENGTHS = {
+  name: 100,
+  email: 254,
+  subject: 200,
+  message: 5000,
+} as const
+
+function validateLengths(data: ContactFormData): string | null {
+  if (data.name.length > MAX_LENGTHS.name) return 'A név túl hosszú.'
+  if (data.email.length > MAX_LENGTHS.email) return 'Az email cím túl hosszú.'
+  if (data.subject.length > MAX_LENGTHS.subject) return 'A tárgy túl hosszú.'
+  if (data.message.length > MAX_LENGTHS.message) return 'Az üzenet túl hosszú.'
+  return null
+}
+
 export async function POST(request: NextRequest) {
   try {
     // Get client IP for rate limiting
@@ -74,6 +91,12 @@ export async function POST(request: NextRequest) {
         { status: 400 }
       )
     }
+
+    // Enforce field length caps before sanitization/persistence
+    const lengthError = validateLengths(body)
+    if (lengthError) {
+      return NextResponse.json({ error: lengthError }, { status: 400 })
+    }
     
     // Validate email format
     if (!validateEmail(body.email)) {

proto/src/app/api/contact/route.unit.test.ts

@@ -64,6 +64,19 @@ describe('/api/contact Unit Tests', () => {
       expect(response.status).toBe(500)
       expect(mockInsertOne).toHaveBeenCalledTimes(1)
     })
+
+    it('rejects an over-long message before persisting', async () => {
+      const longMessage = { ...validData, message: 'x'.repeat(5001) }
+      const request = {
+        headers: new Headers({ 'x-forwarded-for': 'too-long' }),
+        json: async () => longMessage,
+      } as any
+
+      const response = await POST(request)
+
+      expect(response.status).toBe(400)
+      expect(mockInsertOne).not.toHaveBeenCalled()
+    })
   })
 
   // TC-001: Email Format Validation Test (ZEE-48)