feat(audit): truncate stdout/stderr to 64KB + index FlowRun(user_id, started_at desc)

- Truncate accumulated stdout/stderr to last 64KB before persisting FlowStep
  to prevent unbounded DB growth on verbose commands
- Add @@index([user_id, started_at(sort: Desc)]) to FlowRun schema so audit
  list queries (WHERE user_id = ? ORDER BY started_at DESC) use the index
- Add migration 20260513200000_flowrun_user_idx

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/api/flows/start/route.ts

@@ -55,6 +55,10 @@ export async function POST(request: NextRequest) {
 
       enqueue('flow_run_id', { flow_run_id: flowRun.id })
 
+      const TRUNCATE_BYTES = 64 * 1024
+      const truncate = (s: string) =>
+        s.length > TRUNCATE_BYTES ? s.slice(-TRUNCATE_BYTES) : s
+
       let agentResponse: Response
       try {
         agentResponse = await fetch(`${AGENT_URL}/agent/v1/exec`, {
@@ -122,7 +126,7 @@ export async function POST(request: NextRequest) {
                   const now = new Date()
                   await prisma.flowStep.update({
                     where: { id: flowStep.id },
-                    data: { stdout, stderr, exit_code: exitCode, ended_at: now },
+                    data: { stdout: truncate(stdout), stderr: truncate(stderr), exit_code: exitCode, ended_at: now },
                   })
                   await prisma.flowRun.update({
                     where: { id: flowRun.id },