security: reject file uploads exceeding 10 MB

Add a MAX_UPLOAD_BYTES constant (10 MB) to Server and check the
uploaded tempfile size before writing it to disk. Exceeding the limit
returns HTTP 413 with a structured JSON error. Includes a test.

lib/volumen/admin_routes.rb

@@ -88,6 +88,10 @@ module Volumen
         upload = params["file"]
         halt(400, json("error" => "no_file")) unless upload.is_a?(Hash) && upload[:tempfile]
 
+        if upload[:tempfile].size > Server::MAX_UPLOAD_BYTES
+          halt(413, json("error" => "file_too_large", "max_bytes" => Server::MAX_UPLOAD_BYTES))
+        end
+
         json("url" => store.store_upload(upload[:filename], upload[:tempfile]))
       end
 

lib/volumen/server.rb

@@ -17,6 +17,7 @@ module Volumen
   class Server < Sinatra::Base
     MAX_LOGIN_ATTEMPTS = 10
     LOGIN_WINDOW = 60 # seconds
+    MAX_UPLOAD_BYTES = 10 * 1024 * 1024 # 10 MB
     SLUG_REGEX = /\A[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?\z/
 
     register ApiRoutes