fix(api): Add upper bound validation to num_exercises

The /generate and /generate-operations endpoints accepted num_exercises
without an upper bound, allowing DoS via excessively large values.
Add Field(le=100) to both ExerciseRequest and OperationExerciseRequest
Pydantic models to cap exercises at 100.

Fixes vuln-0001

app/main.py

@@ -8,7 +8,7 @@ from typing import List
 from fastapi import FastAPI, Request, Form
 from fastapi.responses import HTMLResponse, RedirectResponse, StreamingResponse
 from fastapi.templating import Jinja2Templates
-from pydantic import BaseModel
+from pydantic import BaseModel, Field
 from fpdf import FPDF
 
 import logging
@@ -68,13 +68,13 @@ class MathExercisesPDF(FPDF):
 class ExerciseRequest(BaseModel):
     min_table: int
     max_table: int
-    num_exercises: int = 15
+    num_exercises: int = Field(15, ge=1, le=100)
     multiplication_only: bool = False
-    max_first_operand: int = 12  # New parameter for the maximum value of the first operand
+    max_first_operand: int = Field(12, ge=1, le=12)  # New parameter for the maximum value of the first operand
 
 
 class OperationExerciseRequest(BaseModel):
-    num_exercises: int = 20
+    num_exercises: int = Field(20, ge=1, le=100)
 
 
 def generate_exercises(