fix(knowledge): verification audit — 3 medium issues

- create_item: wrap item + version INSERT in transaction for atomicity
- update_item handler: validate content length (100KB) before DB hit
- KnowledgeChunk: document missing embedding field, safe per explicit SELECT usage

crates/zclaw-saas/src/knowledge/handlers.rs

@@ -273,6 +273,12 @@ pub async fn update_item(
 ) -> SaasResult<Json<serde_json::Value>> {
     check_permission(&ctx, "knowledge:write")?;
 
+    if let Some(ref content) = req.content {
+        if content.len() > 100_000 {
+            return Err(SaasError::InvalidInput("内容不能超过 100KB".into()));
+        }
+    }
+
     let updated = service::update_item(&state.db, &id, &ctx.account_id, &req).await?;
 
     // 触发 re-embedding