feat: configurable upload file size limits via .env (#695)

* feat: make upload file size limits configurable via .env

Add UPLOAD_MAX_*_MB environment variables for documents, images, videos,
exercise assignment files, AI assistant documents, landing page images,
and media thumbnails. API presign routes validate file size server-side;
dashboard UI reads the same limits from layout data.

* chore: wire upload limit env vars through Docker compose and docs

Pass UPLOAD_MAX_*_MB from the root .env into api and dashboard containers
in both compose files, document them in .env.example and self-hosting guides.

Co-authored-by: Rotimi Best <[email protected]>

* docs: cross-link upload limits in README, Railway, Coolify, and Cloudflare guides

Co-authored-by: Rotimi Best <[email protected]>

* fix: address PR review feedback on upload limits

- Restore 5 MB default for thumbnail uploads (edit-asset-dialog regression)
- Add getResolvedUploadLimits() fallback for Storybook/tests
- Cache core getUploadLimits() like the dashboard helper
- Document presign fileSize as advisory; allow zero-byte fileSize in schema
- Only send fileSize to presign when greater than zero

* docs: remove upload limits from Cloudflare setup guide

---------

packages/core/src/config/env.ts

@@ -88,7 +88,21 @@ const envSchema = z.object({
       const parsed = Number(v);
 
       return Number.isFinite(parsed) && parsed >= 1 ? Math.trunc(parsed) : 500;
-    })
+    }),
+  /** Max course lesson document upload size in megabytes (default 5). */
+  UPLOAD_MAX_DOCUMENT_MB: z.string().optional(),
+  /** Max image upload size in megabytes — avatars, media, editor images (default 5). */
+  UPLOAD_MAX_IMAGE_MB: z.string().optional(),
+  /** Max lesson video upload size in megabytes (default 800). */
+  UPLOAD_MAX_VIDEO_MB: z.string().optional(),
+  /** Max exercise assignment file upload size in megabytes (default 2). */
+  UPLOAD_MAX_EXERCISE_FILE_MB: z.string().optional(),
+  /** Max AI assistant document upload size in megabytes (default 5). */
+  UPLOAD_MAX_AGENT_DOCUMENT_MB: z.string().optional(),
+  /** Max org landing page image upload size in megabytes (default 0.5). */
+  UPLOAD_MAX_LANDING_IMAGE_MB: z.string().optional(),
+  /** Max media thumbnail upload size in megabytes (default 5). */
+  UPLOAD_MAX_THUMBNAIL_MB: z.string().optional()
 });
 
 export const env = envSchema.parse(process.env);

packages/core/src/config/upload-limits.ts

@@ -0,0 +1,15 @@
+import { env } from './env';
+import { resolveUploadLimits, type UploadLimits } from '@cio/utils/config/upload-limits';
+
+export type { UploadLimits } from '@cio/utils/config/upload-limits';
+
+let cachedLimits: UploadLimits | null = null;
+
+export function getUploadLimits(): UploadLimits {
+  if (cachedLimits) {
+    return cachedLimits;
+  }
+
+  cachedLimits = resolveUploadLimits(env);
+  return cachedLimits;
+}

packages/core/src/services/agent/document.ts

@@ -1,12 +1,8 @@
 import { nanoid } from 'nanoid';
 import { AppError } from '@cio/utils/errors';
-import {
-  MAX_DOCUMENT_TEXT_LENGTH,
-  MAX_AGENT_DOCUMENT_SIZE,
-  DOCUMENT_REDIS_TTL,
-  SUPPORTED_DOCUMENT_TYPES
-} from '@cio/ai-assistant';
+import { MAX_DOCUMENT_TEXT_LENGTH, DOCUMENT_REDIS_TTL, SUPPORTED_DOCUMENT_TYPES } from '@cio/ai-assistant';
 import type { DocumentUploadResult } from '@cio/ai-assistant';
+import { getUploadLimits } from '../../config/upload-limits';
 import { agentDocumentKey } from '../../utils/redis-keys';
 import { trackAgentEvent, AgentEvent } from '../../utils/tinybird';
 import type { RedisClient } from '../../utils/redis/redis';
@@ -34,9 +30,11 @@ export async function parseAndStoreDocument(
     throw new AppError('Unsupported file type. Allowed: PDF, DOCX, PPTX', 'UNSUPPORTED_FILE_TYPE', 415);
   }
 
-  if (file.size > MAX_AGENT_DOCUMENT_SIZE) {
+  const maxAgentDocumentSize = getUploadLimits().agentDocumentBytes;
+
+  if (file.size > maxAgentDocumentSize) {
     throw new AppError(
-      `File too large. Maximum size is ${MAX_AGENT_DOCUMENT_SIZE / (1024 * 1024)}MB`,
+      `File too large. Maximum size is ${maxAgentDocumentSize / (1024 * 1024)}MB`,
       'FILE_TOO_LARGE',
       413
     );