harden(plan): 92-day range cap + dedup user_ids on bulk create

src/services/plan.service.ts

@@ -811,6 +811,13 @@ export async function bulkCreateEntries(
   const from = toDateOnly(input.date_from);
   const to = toDateOnly(input.date_to);
 
+  // Bound the work (users × days). Mirror the 92-day cap on GET /plan/grid so
+  // one bulk call can't fan out into thousands of inserts.
+  const rangeDays = Math.round((to.getTime() - from.getTime()) / 86400000) + 1;
+  if (rangeDays > 92) {
+    return { error: "Maximální rozsah je 92 dní", status: 400 };
+  }
+
   // The day list for the whole range (UTC midnights), built once.
   const days: Date[] = [];
   for (let d = new Date(from); d <= to; d.setUTCDate(d.getUTCDate() + 1)) {