Add admin-configurable upload size limits

The 8MB image/file/avatar cap is now a site setting (UploadSettings,
single-row table like SmtpSettings) editable from the Admin Settings tab,
instead of a hardcoded constant. All three upload endpoints read the live
value and interpolate it into their 413 messages. A new GET
/api/uploads/limit endpoint (open to any authenticated user, unlike the
admin-only settings endpoints) lets the composer reject an oversized file
client-side before it ever hits the network, though the server still
enforces the same cap independently.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/app/schemas/upload_settings.py

@@ -0,0 +1,16 @@
+from datetime import datetime
+
+from pydantic import BaseModel, Field
+
+
+class UploadSettingsRead(BaseModel):
+    max_upload_bytes: int
+    updated_at: datetime
+
+
+class UploadSettingsUpdate(BaseModel):
+    # Guardrails against a fat-fingered 0/negative value or an unbounded
+    # figure that could exhaust disk -- 1 MB to 500 MB is generous enough
+    # for any real attachment while still being a sane range to type into
+    # a number input.
+    max_upload_bytes: int = Field(ge=1024 * 1024, le=500 * 1024 * 1024)