Heatmap hm_move points array unbounded (400KB write blowups)

Severity: High · Where: collect.ts:401-408 hm_move checks Array.isArray + length but never truncates. Impact: A single request can exceed the DynamoDB 400KB item limit → write failures / write-amplification DoS. Fix: Cap points per request (and overall).