Validate document content length by extracted text, not JSON size

Add Node.TextLength() to walk the ProseMirror tree and sum actual user
text. Introduce ProseMirrorDocumentMaxTextLength validator that enforces
a 50k character limit on extracted text, paired with a 500k byte safety
cap on the raw JSON string. Extend e2e tests for content length.

Signed-off-by: Émile Ré <emile@getprobo.com>

pkg/validator/validator_prosemirror.go

@@ -15,6 +15,7 @@
 package validator
 
 import (
+	"fmt"
 	"strings"
 
 	"go.probo.inc/probo/pkg/prosemirror"
@@ -42,3 +43,35 @@ func ProseMirrorDocumentContent() ValidatorFunc {
 		return nil
 	}
 }
+
+// ProseMirrorDocumentMaxTextLength validates that the total text content
+// within a ProseMirror/Tiptap JSON document does not exceed maxLength bytes.
+// Only user-visible text is counted; structural markup is excluded.
+// Nil, empty, and whitespace-only values pass. Invalid JSON is skipped
+// (let ProseMirrorDocumentContent handle format errors).
+func ProseMirrorDocumentMaxTextLength(maxLength int) ValidatorFunc {
+	return func(value any) *ValidationError {
+		actualValue, isNil := dereferenceValue(value)
+		if isNil {
+			return nil
+		}
+		s, ok := actualValue.(string)
+		if !ok {
+			return newValidationError(ErrorCodeInvalidFormat, "value must be a string")
+		}
+		if strings.TrimSpace(s) == "" {
+			return nil
+		}
+		n, err := prosemirror.Parse(s)
+		if err != nil {
+			return nil
+		}
+		if n.TextLength() > maxLength {
+			return newValidationError(
+				ErrorCodeTooLong,
+				fmt.Sprintf("text content must be at most %d characters", maxLength),
+			)
+		}
+		return nil
+	}
+}