fix(medications): bound the RxNorm code length

The RxCUI field validates against `^\d+$`, which is unbounded — a caller
could submit an arbitrarily long digit string. Add a `.max(20)` ceiling
as defence-in-depth so the column write stays tight; real RxCUIs are at
most a handful of digits. `atcCode` needs no max — its regex already
fixes the length. Regenerate the OpenAPI contract for the new
`maxLength` on both the create and update bodies.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
(cherry picked from commit 8b97d35bc375ef3b2e70f938c0d6729a5fa6bccb)

docs/api/openapi.yaml

@@ -2564,6 +2564,7 @@ components:
             NULL clears it; absent leaves it untouched.
           anyOf:
             - type: string
+              maxLength: 20
               pattern: ^\d+$
             - type: "null"
         startsOn:
@@ -2782,6 +2783,7 @@ components:
             NULL clears it; absent leaves it untouched.
           anyOf:
             - type: string
+              maxLength: 20
               pattern: ^\d+$
             - type: "null"
         startsOn: