fix(sprint-004): B1 DTO validation, B2 lines clamp, B3 CORS PUT

B1: UpdateHarnessDto @IsString @IsNotEmpty @MaxLength(50000) 추가
B2: getSisterLogs lines clamp(1~500)
B3: CORS methods에 PUT 추가

backend/src/admin/admin.controller.ts

@@ -13,7 +13,12 @@ import { ApiKeyGuard } from '../auth/api-key.guard';
 import { SisterNamePipe } from '../common/sister-name.pipe';
 import type { SisterName } from '../common/sister-name.pipe';
 
+import { IsString, IsNotEmpty, MaxLength } from 'class-validator';
+
 class UpdateHarnessDto {
+  @IsString()
+  @IsNotEmpty()
+  @MaxLength(50000)
   content!: string;
 }
 
@@ -54,6 +59,8 @@ export class AdminController {
     @Param('name', SisterNamePipe) name: SisterName,
     @Query('lines') lines?: string,
   ) {
-    return this.adminService.getSisterLogs(name, lines ? parseInt(lines, 10) : 100);
+    const parsed = lines ? parseInt(lines, 10) : 100;
+    const clamped = Math.min(Math.max(isNaN(parsed) ? 100 : parsed, 1), 500);
+    return this.adminService.getSisterLogs(name, clamped);
   }
 }

backend/src/main.ts

@@ -21,7 +21,7 @@ async function bootstrap() {
         callback(new Error(`CORS: ${origin} not allowed`));
       }
     },
-    methods: ['GET', 'POST', 'PATCH', 'DELETE', 'OPTIONS'],
+    methods: ['GET', 'POST', 'PATCH', 'PUT', 'DELETE', 'OPTIONS'],
     credentials: true,
   });