fix(sensor-placement): enforce project write boundaries

Bind every scheme request to ProjectContext, keep viewer access read-only, reject concurrent optimization jobs without blocking worker threads, and cap export/update payload sizes. Run optimization and workbook work off the event loop.

app/domain/schemas/sensor_placement.py

@@ -39,8 +39,12 @@ class SensorPlacementOptimizeRequest(BaseModel):
 
 
 class SensorPlacementUpdateRequest(BaseModel):
-    expected_sensor_location: list[str] = Field(..., min_length=1)
-    sensor_location: list[str] = Field(..., min_length=1)
+    expected_sensor_location: list[str] = Field(
+        ...,
+        min_length=1,
+        max_length=200,
+    )
+    sensor_location: list[str] = Field(..., min_length=1, max_length=200)
 
     @field_validator("expected_sensor_location", "sensor_location")
     @classmethod
@@ -49,8 +53,11 @@ class SensorPlacementUpdateRequest(BaseModel):
 
 
 class SensorPlacementExportRequest(BaseModel):
-    sensor_location: list[str] = Field(..., min_length=1)
-    adjustment_status: dict[str, AdjustmentStatus] = Field(default_factory=dict)
+    sensor_location: list[str] = Field(..., min_length=1, max_length=200)
+    adjustment_status: dict[str, AdjustmentStatus] = Field(
+        default_factory=dict,
+        max_length=200,
+    )
 
     @field_validator("sensor_location")
     @classmethod