fix(backend): harden write registrar boundaries

backend/internal/config/config.go

@@ -13,6 +13,7 @@ type Config struct {
 	Port                  string   `yaml:"port"`
 	DSN                   string   `yaml:"dsn"`
 	StorageDir            string   `yaml:"storage_dir"`
+	MaxUploadBytes        int64    `yaml:"max_upload_bytes"`
 	AuthSecret            string   `yaml:"auth_secret"`
 	SystemAIKey           string   `yaml:"system_ai_key"`
 	AIKeyEncryptionSecret string   `yaml:"ai_key_encryption_secret"`
@@ -41,5 +42,8 @@ func LoadFromDir(configDir string) (Config, error) {
 	if err := yaml.Unmarshal(data, &cfg); err != nil {
 		return Config{}, err
 	}
+	if cfg.MaxUploadBytes <= 0 {
+		cfg.MaxUploadBytes = 32 << 20
+	}
 	return cfg, nil
 }