M39: harden application and acceptance gates

backend/app/schemas.py

@@ -1,9 +1,10 @@
 from __future__ import annotations
 
+import uuid
 from datetime import datetime
 from typing import Annotated, Any, Literal
 
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, ConfigDict, Field
 
 Role = Literal["operations_manager", "rental_employee"]
 
@@ -423,6 +424,20 @@ class N8nWorkflowEvidence(BaseModel):
     last_execution_id: str | None = None
 
 
+class ReturnCallbackIn(BaseModel):
+    """Body of the n8n return follow-up callback.
+
+    n8n forwards its whole item (``JSON.stringify($json)``), so unknown keys are ignored;
+    only the fields we persist are validated and bounded.
+    """
+
+    model_config = ConfigDict(extra="ignore")
+
+    correlation_id: uuid.UUID | None = None
+    follow_up: str | None = Field(default=None, max_length=200)
+    summary: str | None = Field(default=None, max_length=2000)
+
+
 class N8nHeartbeatIn(BaseModel):
     workflow_id: str = Field(min_length=1, max_length=120)
     workflow_name: str = Field(min_length=1, max_length=200)