fix: validation hardening — agent import prompt limit, relay retry tracking, heartbeat validation

- agent_import: add system_prompt length validation (max 50K chars)
  to prevent excessive token consumption from imported configs
- relay retry_task: wrap JoinHandle to log abort on server shutdown
- device_heartbeat: validate device_id length (1-64 chars) matching
  register endpoint constraints

crates/zclaw-saas/src/relay/handlers.rs

@@ -550,7 +550,7 @@ pub async fn retry_task(
     // 异步执行重试 — 根据解析结果选择执行路径
     let db = state.db.clone();
     let task_id = id.clone();
-    tokio::spawn(async move {
+    let handle = tokio::spawn(async move {
         let result = match model_resolution {
             ModelResolution::Direct(ref candidate) => {
                 service::execute_relay(
@@ -575,6 +575,13 @@ pub async fn retry_task(
             Err(e) => tracing::warn!("Relay task {} 重试失败: {}", task_id, e),
         }
     });
+    // Detach with warning — if server shuts down mid-retry, the task is lost.
+    // The DB status is already reset to 'queued', so a future restart can pick it up.
+    tokio::spawn(async move {
+        if let Err(e) = handle.await {
+            tracing::warn!("Relay retry task aborted (server shutdown?): {}", e);
+        }
+    });
 
     // 异步派发操作日志
     state.dispatch_log_operation(