feat: configurable upload file size limits via .env (#695)

* feat: make upload file size limits configurable via .env

Add UPLOAD_MAX_*_MB environment variables for documents, images, videos,
exercise assignment files, AI assistant documents, landing page images,
and media thumbnails. API presign routes validate file size server-side;
dashboard UI reads the same limits from layout data.

* chore: wire upload limit env vars through Docker compose and docs

Pass UPLOAD_MAX_*_MB from the root .env into api and dashboard containers
in both compose files, document them in .env.example and self-hosting guides.

Co-authored-by: Rotimi Best <[email protected]>

* docs: cross-link upload limits in README, Railway, Coolify, and Cloudflare guides

Co-authored-by: Rotimi Best <[email protected]>

* fix: address PR review feedback on upload limits

- Restore 5 MB default for thumbnail uploads (edit-asset-dialog regression)
- Add getResolvedUploadLimits() fallback for Storybook/tests
- Cache core getUploadLimits() like the dashboard helper
- Document presign fileSize as advisory; allow zero-byte fileSize in schema
- Only send fileSize to presign when greater than zero

* docs: remove upload limits from Cloudflare setup guide

---------

apps/dashboard/src/lib/utils/config/upload-limits-context.ts

@@ -0,0 +1,23 @@
+import { getContext, setContext } from 'svelte';
+import { resolveUploadLimits, type UploadLimits } from '@cio/utils/config/upload-limits';
+import type { UploadLimits as DashboardUploadLimits } from './upload-limits';
+
+const UPLOAD_LIMITS_CONTEXT_KEY = Symbol('upload-limits');
+
+export function setUploadLimitsContext(limits: DashboardUploadLimits) {
+  setContext(UPLOAD_LIMITS_CONTEXT_KEY, limits);
+}
+
+export function getUploadLimitsContext(): DashboardUploadLimits | null {
+  return getContext<DashboardUploadLimits | null>(UPLOAD_LIMITS_CONTEXT_KEY) ?? null;
+}
+
+/** Built-in defaults when layout context is absent (e.g. Storybook, isolated tests). */
+export function getDefaultUploadLimits(): UploadLimits {
+  return resolveUploadLimits({});
+}
+
+/** Layout-provided limits, or built-in defaults outside the dashboard layout tree. */
+export function getResolvedUploadLimits(): UploadLimits {
+  return getUploadLimitsContext() ?? getDefaultUploadLimits();
+}

apps/dashboard/src/lib/utils/config/upload-limits.ts

@@ -0,0 +1,24 @@
+import { resolveUploadLimits, type UploadLimits } from '@cio/utils/config/upload-limits';
+import { env } from '$env/dynamic/private';
+
+let cachedLimits: UploadLimits | null = null;
+
+export function getUploadLimits(): UploadLimits {
+  if (cachedLimits) {
+    return cachedLimits;
+  }
+
+  cachedLimits = resolveUploadLimits({
+    UPLOAD_MAX_DOCUMENT_MB: env.UPLOAD_MAX_DOCUMENT_MB,
+    UPLOAD_MAX_IMAGE_MB: env.UPLOAD_MAX_IMAGE_MB,
+    UPLOAD_MAX_VIDEO_MB: env.UPLOAD_MAX_VIDEO_MB,
+    UPLOAD_MAX_EXERCISE_FILE_MB: env.UPLOAD_MAX_EXERCISE_FILE_MB,
+    UPLOAD_MAX_AGENT_DOCUMENT_MB: env.UPLOAD_MAX_AGENT_DOCUMENT_MB,
+    UPLOAD_MAX_LANDING_IMAGE_MB: env.UPLOAD_MAX_LANDING_IMAGE_MB,
+    UPLOAD_MAX_THUMBNAIL_MB: env.UPLOAD_MAX_THUMBNAIL_MB
+  });
+
+  return cachedLimits;
+}
+
+export type { UploadLimits };

apps/dashboard/src/lib/utils/services/courses/presign.ts

@@ -52,8 +52,12 @@ export class GenericUploader {
   async getPresignedUrl(file: File) {
     const result =
       this.uploadType === 'document'
-        ? await presignApi.getDocumentUploadUrl(file?.name ?? '', file?.type ?? '')
-        : await presignApi.getVideoUploadUrl(file?.name ?? '', file?.type ?? '');
+        ? await presignApi.getDocumentUploadUrl(
+            file?.name ?? '',
+            file?.type ?? '',
+            file.size > 0 ? file.size : undefined
+          )
+        : await presignApi.getVideoUploadUrl(file?.name ?? '', file?.type ?? '', file.size > 0 ? file.size : undefined);
 
     if (!result) {
       throw new Error('Failed to get presigned upload URL');