Reject over-limit drops server-side and snap the card back with a streamed toast.