fix: 校验守门按字节+递归长度+非dict拒绝

- 体积守门改 UTF-8 字节数（原按字符数，"汉"*1500 约 4.5KB 可绕过 4096 上限）
- 字符串长度检查并入 _walk_props 递归，嵌套字符串同样受 MAX_STR_LEN 约束
  （顺序：体积先行，故同一值既超长又超体积时报 properties_too_large）
- properties 传了但非 dict（[]/""/0/None）不再被 or {} 静默放行，缺省键仍放行

Co-Authored-By: Claude Code <noreply@anthropic.com>

server/tracker/tests/test_validation.py

@@ -47,3 +47,13 @@ def test_nested_sensitive_key_rejected():
 
 def test_naive_datetime_rejected():
     assert validate_event(_ev(occurred_at=NOW.replace(tzinfo=None))) == "invalid_occurred_at"
+
+def test_prop_size_gate_counts_bytes():
+    r = validate_event(_ev(properties={"utm": {"a": "汉" * 1500}}))
+    assert r == "properties_too_large"      # 字符数约 2K 未超，UTF-8 约 4.5KB 超 4096，须按字节算
+
+def test_nested_string_length_capped():
+    assert validate_event(_ev(properties={"utm": {"a": "x" * 600}})) == "properties_too_long"
+
+def test_falsy_non_dict_properties_rejected():
+    assert validate_event(_ev(properties=[])) == "properties_invalid"