feat: configurable upload file size limits via .env (#695)

* feat: make upload file size limits configurable via .env

Add UPLOAD_MAX_*_MB environment variables for documents, images, videos,
exercise assignment files, AI assistant documents, landing page images,
and media thumbnails. API presign routes validate file size server-side;
dashboard UI reads the same limits from layout data.

* chore: wire upload limit env vars through Docker compose and docs

Pass UPLOAD_MAX_*_MB from the root .env into api and dashboard containers
in both compose files, document them in .env.example and self-hosting guides.

Co-authored-by: Rotimi Best <[email protected]>

* docs: cross-link upload limits in README, Railway, Coolify, and Cloudflare guides

Co-authored-by: Rotimi Best <[email protected]>

* fix: address PR review feedback on upload limits

- Restore 5 MB default for thumbnail uploads (edit-asset-dialog regression)
- Add getResolvedUploadLimits() fallback for Storybook/tests
- Cache core getUploadLimits() like the dashboard helper
- Document presign fileSize as advisory; allow zero-byte fileSize in schema
- Only send fileSize to presign when greater than zero

* docs: remove upload limits from Cloudflare setup guide

---------

apps/api/src/constants/upload.ts

@@ -1,7 +1,15 @@
+import { getUploadLimits } from '@cio/core/config/upload-limits';
+
+const limits = getUploadLimits();
+
 // API-specific constants (file size limits)
-export const MAX_FILE_SIZE = 800 * 1024 * 1024; // 800MB
-export const MAX_DOCUMENT_SIZE = 5 * 1024 * 1024; // 5MB
-export const MAX_IMAGE_SIZE = 5 * 1024 * 1024; // 5MB
+export const MAX_FILE_SIZE = limits.videoBytes;
+export const MAX_DOCUMENT_SIZE = limits.documentBytes;
+export const MAX_IMAGE_SIZE = limits.imageBytes;
+export const MAX_EXERCISE_FILE_SIZE = limits.exerciseFileBytes;
+export const MAX_AGENT_DOCUMENT_SIZE = limits.agentDocumentBytes;
+
+export { getUploadLimits };
 
 // API-specific constants (bucket names)
 export const BUCKET_NAME = {

apps/api/src/routes/agent/agent.ts

@@ -6,6 +6,7 @@ import { orgAdminMiddleware } from '@api/middlewares/org-admin';
 import { authOrApiKeyMiddleware } from '@api/middlewares/auth-or-api-key';
 import { b64EnvelopeRewrite } from '@api/middlewares/b64-envelope';
 import { handleError, AppError } from '@api/utils/errors';
+import { MAX_AGENT_DOCUMENT_SIZE } from '@api/constants/upload';
 import { zValidator } from '@hono/zod-validator';
 import { streamText, stepCountIs, convertToModelMessages } from 'ai';
 import {
@@ -171,7 +172,7 @@ const agentCoreRouter = new Hono()
     } catch (error) {
       if (error instanceof AppError) {
         if (error.statusCode === 413) {
-          return c.json({ success: false, error: 'file_too_large', maxSize: 5242880 }, 413);
+          return c.json({ success: false, error: 'file_too_large', maxSize: MAX_AGENT_DOCUMENT_SIZE }, 413);
         }
 
         if (error.statusCode === 415) {

apps/api/src/routes/course/presign.ts

@@ -14,6 +14,19 @@ import {
 import { Hono } from '@api/utils/hono';
 import { authMiddleware } from '@api/middlewares/auth';
 import { generateFileKey } from '@cio/core/utils/upload';
+import { AppError } from '@api/utils/errors';
+import { MAX_DOCUMENT_SIZE, MAX_FILE_SIZE } from '@api/constants/upload';
+
+/**
+ * Advisory check on client-reported `fileSize`. Upload bytes go directly to object storage
+ * via the presigned PUT URL, so omitting `fileSize` (or understating it) bypasses this guard.
+ * Real enforcement requires storage-side policies (bucket max object size, etc.).
+ */
+function assertPresignFileSizeWithinLimit(fileSize: number | undefined, maxBytes: number): void {
+  if (fileSize != null && fileSize > maxBytes) {
+    throw new AppError(`File size exceeds maximum of ${maxBytes / 1024 / 1024}MB`, 'FILE_TOO_LARGE', 413);
+  }
+}
 
 // Response schemas for OpenAPI documentation
 const PresignUploadResponse = {
@@ -68,7 +81,10 @@ export const presignRouter = new Hono()
     async (c) => {
       const body = c.req.valid('json');
 
-      const { fileName, fileType } = body;
+      const { fileName, fileType, fileSize } = body;
+
+      assertPresignFileSizeWithinLimit(fileSize, MAX_FILE_SIZE);
+
       const fileKey = generateFileKey(fileName);
 
       const presignedUrl = await generateVideoUploadPresignedUrl(fileKey, fileType);
@@ -108,7 +124,10 @@ export const presignRouter = new Hono()
     async (c) => {
       const body = c.req.valid('json');
 
-      const { fileName, fileType } = body;
+      const { fileName, fileType, fileSize } = body;
+
+      assertPresignFileSizeWithinLimit(fileSize, MAX_DOCUMENT_SIZE);
+
       const fileKey = generateFileKey(fileName);
 
       const presignedUrl = await generateDocumentUploadPresignedUrl(fileKey, fileType);