feat(import): harden workbook parser boundaries

docs/import-hardening.md

@@ -8,7 +8,7 @@
 - Untrusted workbook imports no longer accept legacy `.xls`.
 - Server-side dispo imports accept only `.xlsx` files.
 - Browser-side ad hoc imports accept `.xlsx` and `.csv`.
-- Trusted export generation may still use `xlsx` until the export paths are migrated separately.
+- Workbook import and export generation now use `exceljs` instead of direct runtime `xlsx` usage.
 
 ## Server Boundary
 
@@ -18,7 +18,9 @@ The dispo-import reader in [read-workbook.ts](/home/hartmut/Documents/Copilot/ca
 - regular-file checks
 - non-empty file checks
 - a hard size limit of `15 MiB`
-- `.xlsx`-only parsing behind a hardened server-side parser boundary
+- a worksheet row limit of `10,000`
+- a worksheet column limit of `256`
+- `.xlsx`-only parsing through `exceljs` behind a hardened server-side parser boundary
 
 The API entry points in [dispo.ts](/home/hartmut/Documents/Copilot/capakraken/packages/api/src/router/dispo.ts) reject non-`.xlsx` workbook paths before staging or validation begins.
 
@@ -28,6 +30,9 @@ The browser import helpers in [excel.ts](/home/hartmut/Documents/Copilot/capakra
 
 - a hard client-side file size limit of `10 MiB`
 - explicit rejection of legacy `.xls`
+- a tabular row limit of `5,000` data rows plus the header row
+- a tabular column limit of `200`
+- header validation that rejects blank and duplicate column names
 - `.xlsx` parsing through `exceljs`
 - `.csv` parsing through a local parser for simple tabular imports
 
@@ -41,6 +46,7 @@ Affected upload flows:
 ## Rationale
 
 - `.xls` support keeps the old binary workbook format in the untrusted path without enough payoff.
-- the server path keeps compatibility-first `.xlsx` parsing for the current dispo workbooks, but only behind explicit file validation and limits
-- the browser path moves away from blanket `xlsx` import usage to a narrower parser boundary
+- the server path keeps compatibility-first `.xlsx` parsing for the current dispo workbooks, but only behind explicit file validation, size limits, and `exceljs`
+- the browser path moves away from blanket spreadsheet parsing to a narrower parser boundary
+- export generation follows the same maintained workbook stack as import parsing
 - CSV remains useful for lightweight business imports and is small enough to parse with a narrow local parser.