fix(backend): harden write registrar boundaries

backend/internal/config/config.go

@@ -13,6 +13,7 @@ type Config struct {
 	Port                  string   `yaml:"port"`
 	DSN                   string   `yaml:"dsn"`
 	StorageDir            string   `yaml:"storage_dir"`
+	MaxUploadBytes        int64    `yaml:"max_upload_bytes"`
 	AuthSecret            string   `yaml:"auth_secret"`
 	SystemAIKey           string   `yaml:"system_ai_key"`
 	AIKeyEncryptionSecret string   `yaml:"ai_key_encryption_secret"`
@@ -41,5 +42,8 @@ func LoadFromDir(configDir string) (Config, error) {
 	if err := yaml.Unmarshal(data, &cfg); err != nil {
 		return Config{}, err
 	}
+	if cfg.MaxUploadBytes <= 0 {
+		cfg.MaxUploadBytes = 32 << 20
+	}
 	return cfg, nil
 }

backend/internal/config/config_test.go

@@ -21,6 +21,7 @@ func TestLoadFromDirDefaultsToDevYAML(t *testing.T) {
 	require.Equal(t, "18080", cfg.Port)
 	require.Equal(t, "postgres://dev", cfg.DSN)
 	require.Equal(t, "./dev-files", cfg.StorageDir)
+	require.Equal(t, int64(32<<20), cfg.MaxUploadBytes)
 	require.Equal(t, "dev-auth", cfg.AuthSecret)
 	require.Equal(t, "dev-system", cfg.SystemAIKey)
 	require.Equal(t, "dev-ai", cfg.AIKeyEncryptionSecret)