perf(*): bound list queries, batch fetches, harden media downloads

backend/src/api/routers/discover.py

@@ -13,7 +13,7 @@ from utils.policy import repository as policy_repository
 from utils.policy.defaults import TRACKING
 from utils.policy.models import ScopeType
 from utils.read import discover
-from utils.read.models import DiscoverItem
+from utils.read.models import MAX_LIMIT, DiscoverItem
 
 router = APIRouter(prefix="/api", tags=["discover"], route_class=DishkaRoute)
 
@@ -68,6 +68,7 @@ async def discover_peers(
 ) -> list[DiscoverItem]:
     if not query.strip():
         return []
+    limit = min(limit, MAX_LIMIT)
     items = await discover.search(pool, account_id, query, limit)
     if not remote:
         return items