TIM-346: Server-and-client-side size validation

Inputs in any user-editable text box that are too large will be rejected
without an AJAX call.

Inputs delivered via Python to the API which are too large will be
rejected with an approriate API error.

TODO:
 * @talbs .message__content is styled very badly everywhere
 * Sizes are way too big, currently defaulting to 1MB for API and 256KB
   for js
 * Sizes are configured in too many places, when they should come in via
   settings or something