fix(limits): lower the session ceiling to 462 so the layout budget holds

An owner's tab layout holds at most MAX_TAB_REFS (512) refs, counting saved web
tabs (up to MAX_WEBVIEWS, 50 by default) as well as sessions. With a ceiling of
500, session creation could still fail with HTTP 500 on the layout limit before
the capacity message. 512 - 50 = 462; a test pins the ceiling plus MAX_WEBVIEWS
inside MAX_TAB_REFS so the two limits cannot drift apart again.

Co-Authored-By: Christian Haberl <116439789+christianhaberl@users.noreply.github.com>
Co-Authored-By: Claude <noreply@anthropic.com>

src/config/map-limits.ts

@@ -22,13 +22,14 @@
 const DEFAULT_MAX_CONCURRENT_SESSIONS = 50;
 
 /**
- * Highest value `CODEMAN_MAX_SESSIONS` can raise the cap to. Other bounds assume
- * the session count stays small: an owner's tab layout holds at most
- * `MAX_TAB_REFS` (512) refs and `PUT /api/session-order` accepts at most 500 ids,
- * so a larger cap would let session creation fail with a 500 instead of the
- * capacity message.
+ * Highest value `CODEMAN_MAX_SESSIONS` can raise the cap to. An owner's tab layout
+ * holds at most `MAX_TAB_REFS` (512) refs, and those count saved web tabs as well
+ * as sessions; an owner can save up to `MAX_WEBVIEWS` (50 by default) web tabs.
+ * 512 - 50 = 462 keeps session creation answering with the capacity message
+ * instead of failing with a 500 on the layout limit. (`PUT /api/session-order`
+ * accepts up to 500 ids, which stays above this.)
  */
-export const MAX_CONCURRENT_SESSIONS_CEILING = 500;
+export const MAX_CONCURRENT_SESSIONS_CEILING = 462;
 
 /**
  * Resolve the session cap from `CODEMAN_MAX_SESSIONS` (a positive integer,

src/web/schemas.ts

@@ -1981,7 +1981,7 @@ export const CaseOrderSchema = z.object({
 /** PUT /api/session-order — global tab order (ordered sessionIds), COD-131 */
 export const SessionOrderUpdateSchema = z.object({
   // Bounded defensively: ids are uuid-ish (<=100 chars) and the client pushes only
-  // its open-tab order (max sessions is 50 by default, at most 500 via CODEMAN_MAX_SESSIONS,
+  // its open-tab order (max sessions is 50 by default, at most 462 via CODEMAN_MAX_SESSIONS,
   // see MAX_CONCURRENT_SESSIONS_CEILING) — 500 leaves enough room while
   // keeping a hostile/buggy client from persisting megabytes into state.json.
   order: z.array(z.string().max(100)).max(500),