Add admin-configurable upload size limits

The 8MB image/file/avatar cap is now a site setting (UploadSettings,
single-row table like SmtpSettings) editable from the Admin Settings tab,
instead of a hardcoded constant. All three upload endpoints read the live
value and interpolate it into their 413 messages. A new GET
/api/uploads/limit endpoint (open to any authenticated user, unlike the
admin-only settings endpoints) lets the composer reject an oversized file
client-side before it ever hits the network, though the server still
enforces the same cap independently.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

frontend/src/api/admin.ts

@@ -6,6 +6,7 @@ import type {
   EventSubscriptionAdmin,
   SiteInvite,
   SmtpSettings,
+  UploadSettings,
   WebhookIncomingAdmin,
 } from '../types'
 
@@ -105,3 +106,14 @@ export function updateSmtpSettings(payload: SmtpSettingsPayload): Promise<SmtpSe
 export function sendTestSmtpEmail(): Promise<void> {
   return apiFetch<void>('/api/admin/settings/smtp/test', { method: 'POST' })
 }
+
+export function getUploadSettings(): Promise<UploadSettings> {
+  return apiFetch<UploadSettings>('/api/admin/settings/uploads')
+}
+
+export function updateUploadSettings(maxUploadBytes: number): Promise<UploadSettings> {
+  return apiFetch<UploadSettings>('/api/admin/settings/uploads', {
+    method: 'PUT',
+    body: JSON.stringify({ max_upload_bytes: maxUploadBytes }),
+  })
+}