fix(validation): enforce documented filter prompt limits

[vivekvar-dl]

Summary

• enforce the documented 1–750 character boundary for new filterPrompt values
• keep null valid so callers can clear an existing prompt
• separate request and response schemas so legacy empty values can still be read without a client-side parse failure
• add boundary coverage for 1, 750, empty, and 751-character values

This is related to #1698, but does not claim to fix the persistence bug because the settings storage handler is not present in this repository. It closes the adjacent validation gap called out in the issue discussion.

Verification

• bun test packages/validation/api.test.ts (35 passed)
• bun run --cwd packages/validation check-types
• bun run --cwd packages/lib check-types
• git diff --check

Repository-wide checks

• bun run format-lint — blocked by existing repository diagnostics (3 errors and 104 warnings, including Biome schema-version mismatches); no fixes were applied
• bun run check-types — blocked in the unchanged packages/ui/components/shadcn-io/dropzone.tsx because react-dropzone is not declared/installed
• bun run build — all 7 build tasks completed successfully; the root command then failed in postbuild because the Sentry upload requires a maintainer auth token