fix(node): bound the panel GUIDs a peer reports

A peer's panelGuid is copied into nodes.guid and into every inbound row
it reports (an indexed column), a forwarded origin GUID likewise, and a
GUID-keyed IP tree or a master's global-traffic push keys one row per
client. One oversized value therefore multiplied into gigabytes stored.
GUIDs over 64 bytes (panels mint 36-character UUIDs) now fail the
heartbeat, fall back to the reporting node's key, or are dropped.

internal/web/service/node_probe_body_cap_test.go

@@ -48,3 +48,19 @@ func TestProbeRejectsOversizedStatusBody(t *testing.T) {
 		t.Fatalf("LastError = %q, want a \"decode response: \" rejection", patch.LastError)
 	}
 }
+
+// A panelGuid is copied into every inbound the node reports and into indexed columns, so
+// one oversized value multiplies into gigabytes of stored copies.
+func TestProbeRefusesAnOversizedPanelGuid(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = w.Write([]byte(`{"success":true,"obj":{"cpuPct":1,"panelGuid":"` + strings.Repeat("g", maxPanelGuidLen+1) + `"}}`))
+	}))
+	defer srv.Close()
+	u, _ := url.Parse(srv.URL)
+	port, _ := strconv.Atoi(u.Port())
+	n := &model.Node{Id: 1, Scheme: "http", Address: u.Hostname(), Port: port, BasePath: "/", Enable: true, AllowPrivateAddress: true}
+	patch, err := (&NodeService{}).Probe(context.Background(), n)
+	if err == nil || patch.Guid != "" || !strings.Contains(patch.LastError, "panelGuid") {
+		t.Fatalf("Probe = guid %d bytes, %v (%q); want the heartbeat refused", len(patch.Guid), err, patch.LastError)
+	}
+}