Add admin-configurable upload size limits

The 8MB image/file/avatar cap is now a site setting (UploadSettings,
single-row table like SmtpSettings) editable from the Admin Settings tab,
instead of a hardcoded constant. All three upload endpoints read the live
value and interpolate it into their 413 messages. A new GET
/api/uploads/limit endpoint (open to any authenticated user, unlike the
admin-only settings endpoints) lets the composer reject an oversized file
client-side before it ever hits the network, though the server still
enforces the same cap independently.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/app/models/__init__.py

@@ -13,6 +13,7 @@ from app.models.push_subscription import PushSubscription
 from app.models.room import Room
 from app.models.site_invite import SiteInvite
 from app.models.smtp_settings import SmtpSettings
+from app.models.upload_settings import UploadSettings
 from app.models.user import User
 from app.models.webhook_incoming import WebhookIncoming
 
@@ -30,6 +31,7 @@ __all__ = [
     "PasswordReset",
     "SiteInvite",
     "SmtpSettings",
+    "UploadSettings",
     "PushSubscription",
     "AdminAuditLog",
     "ApiToken",