fix(backend): harden write registrar boundaries

backend/cmd/api/main.go

@@ -29,7 +29,7 @@ func main() {
 	tagHandler := projects.NewTagHandler(projectService)
 	cronHandler := projects.NewCronHandler(projectService)
 	taskHandler := tasks.NewHandler(taskService)
-	fileHandler := files.NewHandler(fileService)
+	fileHandler := files.NewHandler(fileService, cfg.MaxUploadBytes)
 	inboxHandler := inbox.NewHandler(inbox.NewService(inbox.StaticAnalyzer{}))
 	authHandler := auth.NewHandler(authService)
 	// search 与 AI 当前只有 service，尚无 HTTP registrar；后续功能任务应在实现真实契约后从此处注入，不能注册伪端点。