fix(backend): widen plot_config size cap to fit a full hiddenSubjects list

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/routes/experiments.js

@@ -224,9 +224,10 @@ function validateSubjectTemplate(template) {
   return null;
 }
 
-// Upper bound on the stored UI-preference blob. Generous for the known fields;
-// guards against a client persisting an arbitrarily large object.
-const PLOT_CONFIG_MAX_BYTES = 16 * 1024;
+// Upper bound on the stored UI-preference blob. Sized to comfortably hold the known
+// fields plus a full hiddenSubjects list (≤500 UUIDs ≈ 20 KB) with headroom, while
+// still guarding against a client persisting an arbitrarily large object.
+const PLOT_CONFIG_MAX_BYTES = 64 * 1024;
 
 // The blob is intentionally schema-loose (clients may add display keys over time);
 // only hiddenSubjects is structurally validated since the backend reasons about it.

backend/tests/experiments.test.js

@@ -176,7 +176,7 @@ describe('PUT /api/experiments/:id/plot-config', () => {
 
   it('rejects an oversized config with 422', async () => {
     prisma.experiment.findUnique.mockResolvedValue(EXPERIMENT);
-    const big = { blob: 'x'.repeat(20000) };
+    const big = { blob: 'x'.repeat(70000) };
     const res = await request(app).put(`/api/experiments/${EXPERIMENT.id}/plot-config`).send(big);
     expect(res.status).toBe(422);
     expect(prisma.experiment.update).not.toHaveBeenCalled();