fix(uploads): bound direct upload reads

* Stabilize full test collection

* Add bounded reads for direct uploads

src/upload_limits.py

@@ -0,0 +1,22 @@
+"""Small helpers for route-local upload size caps."""
+
+from fastapi import HTTPException, UploadFile
+
+
+def format_byte_limit(limit: int) -> str:
+    if limit % (1024 * 1024) == 0:
+        return f"{limit // (1024 * 1024)} MB"
+    if limit % 1024 == 0:
+        return f"{limit // 1024} KB"
+    return f"{limit} bytes"
+
+
+async def read_upload_limited(upload: UploadFile, limit: int, label: str = "Upload") -> bytes:
+    """Read an UploadFile with a hard byte cap."""
+    data = await upload.read(limit + 1)
+    if len(data) > limit:
+        raise HTTPException(
+            status_code=413,
+            detail=f"{label} exceeds {format_byte_limit(limit)} limit",
+        )
+    return data