fix: use per-request upload limit from DB and fix silent truncation

Reads max_upload_size_bytes from instance_settings per-request and
passes it to request.file() so Fastify kills the stream at the
admin's configured limit. Checks file.truncated to properly reject
files that exceed the limit instead of saving corrupted data.

packages/server/src/index.ts

@@ -61,7 +61,7 @@ async function main(): Promise<void> {
 
   await app.register(multipart, {
     limits: {
-      fileSize: config.maxUploadSize,
+      fileSize: 500 * 1024 * 1024,  // 500MB hard ceiling — actual limit enforced per-request
     },
   });