Add admin-configurable upload size limits

The 8MB image/file/avatar cap is now a site setting (UploadSettings,
single-row table like SmtpSettings) editable from the Admin Settings tab,
instead of a hardcoded constant. All three upload endpoints read the live
value and interpolate it into their 413 messages. A new GET
/api/uploads/limit endpoint (open to any authenticated user, unlike the
admin-only settings endpoints) lets the composer reject an oversized file
client-side before it ever hits the network, though the server still
enforces the same cap independently.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/app/routers/uploads.py

@@ -0,0 +1,22 @@
+from fastapi import APIRouter, Depends
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.database import get_db
+from app.dependencies import get_current_user
+from app.models import User
+from app.schemas.upload_settings import UploadSettingsRead
+from app.services.upload_settings_service import get_upload_settings
+
+router = APIRouter(prefix="/api/uploads", tags=["uploads"])
+
+
+@router.get("/limit", response_model=UploadSettingsRead)
+async def get_upload_limit_endpoint(
+    current_user: User = Depends(get_current_user),
+    db: AsyncSession = Depends(get_db),
+):
+    """Any authenticated user (not just site admins -- unlike
+    /api/admin/settings/uploads) can read the current cap, so the composer
+    can validate client-side before uploading."""
+    cfg = await get_upload_settings(db)
+    return UploadSettingsRead(max_upload_bytes=cfg.max_upload_bytes, updated_at=cfg.updated_at)