feat(audit): truncate stdout/stderr to 64KB + index FlowRun(user_id, started_at desc)

- Truncate accumulated stdout/stderr to last 64KB before persisting FlowStep
  to prevent unbounded DB growth on verbose commands
- Add @@index([user_id, started_at(sort: Desc)]) to FlowRun schema so audit
  list queries (WHERE user_id = ? ORDER BY started_at DESC) use the index
- Add migration 20260513200000_flowrun_user_idx

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/api/flows/start/route.ts

@@ -55,6 +55,10 @@ export async function POST(request: NextRequest) {
 
       enqueue('flow_run_id', { flow_run_id: flowRun.id })
 
+      const TRUNCATE_BYTES = 64 * 1024
+      const truncate = (s: string) =>
+        s.length > TRUNCATE_BYTES ? s.slice(-TRUNCATE_BYTES) : s
+
       let agentResponse: Response
       try {
         agentResponse = await fetch(`${AGENT_URL}/agent/v1/exec`, {
@@ -122,7 +126,7 @@ export async function POST(request: NextRequest) {
                   const now = new Date()
                   await prisma.flowStep.update({
                     where: { id: flowStep.id },
-                    data: { stdout, stderr, exit_code: exitCode, ended_at: now },
+                    data: { stdout: truncate(stdout), stderr: truncate(stderr), exit_code: exitCode, ended_at: now },
                   })
                   await prisma.flowRun.update({
                     where: { id: flowRun.id },

prisma/migrations/20260513200000_flowrun_user_idx/migration.sql

@@ -0,0 +1,2 @@
+-- CreateIndex
+CREATE INDEX "FlowRun_user_id_started_at_idx" ON "FlowRun"("user_id", "started_at" DESC);

prisma/schema.prisma

@@ -42,6 +42,8 @@ model FlowRun {
   exit_code  Int?
   user       User       @relation(fields: [user_id], references: [id], onDelete: Cascade)
   steps      FlowStep[]
+
+  @@index([user_id, started_at(sort: Desc)])
 }
 
 model FlowStep {