Heatmap hm_scroll scrollDepths object unbounded (400KB blowups)

Severity: High · Where: collect.ts:427; merge at orm/index.ts:1304-1307 scrollDepths is stored as-is and merged across requests with no bound → same DynamoDB 400KB blow-up risk as the move-heatmap. Fix: Cap/bucket scroll-depth keys; bound the merged object.