fix(12.2): close code-review blockers on uploads, JSON caps, and pivot fill

Keep form save behind in-flight uploads, make retries idempotent via X-Upload-Id, cap remaining JSON bodies, and surface pending pivot type errors instead of zeroing them.

Co-authored-by: Cursor <cursoragent@cursor.com>

modules/cabana/relation_child_test.go

@@ -586,3 +586,25 @@ func TestRelationChildPurgeModels(t *testing.T) {
 		t.Fatalf("listed models failed boot: %v", err)
 	}
 }
+
+// TestPendingPivotFillError: a deferred pivot value that no longer fits
+// the column is an error, not a silent zero (WR-04).
+func TestPendingPivotFillError(t *testing.T) {
+	env := newDeferredEnv(t)
+	key := newSessionKey(t)
+	h := sk(key)
+	m := env.member(t, "p-"+env.stamp+"@example.test")
+	want(t, "link", env.a.do(t, http.MethodPost, dfPath(0, "/relations/members/link"), map[string]any{"ids": []uint{m}, "pivot": map[string]any{"note": "ok"}}, h), http.StatusOK)
+	bad := `{"created":false,"pivot":{"note":true}}`
+	if err := env.db.Model(&lagoon.DeferredBinding{}).Where("session_key = ? AND master_field = ?", key, "members").Update("pivot_data", bad).Error; err != nil {
+		t.Fatal(err)
+	}
+	shown := env.a.do(t, http.MethodGet, dfPath(0, fmt.Sprintf("/relations/members/pivot/%d", m)), nil, h)
+	if shown.Code < 400 {
+		t.Fatalf("show bad pivot: status=%d body=%s", shown.Code, shown.Body.String())
+	}
+	edited := env.a.do(t, http.MethodPut, dfPath(0, fmt.Sprintf("/relations/members/pivot/%d", m)), map[string]any{"note": "x"}, h)
+	if edited.Code < 400 {
+		t.Fatalf("update bad pivot: status=%d body=%s", edited.Code, edited.Body.String())
+	}
+}