fix(credential-groups): correct the OAuth code bound's doc comment

The constant's comment claimed every callback contract shares the bound, but the
Shopify and MCP callback schemas leave `code` unbounded. Describe what the bound
is and why it is sized as it is, without asserting an adoption scope that would
go stale as contracts are migrated onto it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013e5sXbYST2R4qNzM996GFg

Author: waleedlatif1

apps/sim/lib/api/contracts/primitives.ts

@@ -238,7 +238,7 @@ export function withMissingFieldMessage<TSchema extends z.ZodString>(
 export const MAX_ID_LENGTH = 128
 
 /**
- * Bound for an OAuth `code` callback parameter, shared by every callback contract.
+ * Bound for an OAuth `code` callback parameter.
  *
  * Authorization codes have no length ceiling in RFC 6749, and providers differ by
  * orders of magnitude: Slack's are tens of characters while Atlassian returns a