fix(api): 服务器显示名称限 64 个可见字符，拒绝换行、控制符和不可见格式符

internal/api/handlers_patch_test.go

@@ -177,6 +177,16 @@ func TestPatchServerRejections(t *testing.T) {
 			body:     `{"displayName":"x"}`,
 			wantCode: http.StatusBadRequest, wantErr: "bad_name",
 		},
+		{
+			name:     "display name too long",
+			body:     `{"displayName":"` + strings.Repeat("x", 65) + `"}`,
+			wantCode: http.StatusBadRequest, wantErr: "bad_display_name",
+		},
+		{
+			name:     "display name with a right-to-left override",
+			body:     `{"displayName":"abc` + string(rune(0x202E)) + `exe.txt"}`,
+			wantCode: http.StatusBadRequest, wantErr: "bad_display_name",
+		},
 		{
 			name:     "empty autostart policy",
 			body:     `{"autostartPolicy":""}`,