security: reject file uploads exceeding 10 MB

Add a MAX_UPLOAD_BYTES constant (10 MB) to Server and check the
uploaded tempfile size before writing it to disk. Exceeding the limit
returns HTTP 413 with a structured JSON error. Includes a test.

test/admin_test.rb

@@ -124,6 +124,19 @@ class AdminTest < Minitest::Test
     assert_equal 403, last_response.status
   end
 
+  def test_upload_rejects_file_too_large
+    login
+    get "/admin/posts/new"
+    token = csrf(last_response.body)
+    big_path = File.join(@dir, "big.png")
+    File.binwrite(big_path, "X" * (Volumen::Server::MAX_UPLOAD_BYTES + 1))
+    post "/admin/uploads",
+         "_csrf" => token,
+         "file" => Rack::Test::UploadedFile.new(big_path, "image/png")
+    assert_equal 413, last_response.status
+    assert_equal "file_too_large", JSON.parse(last_response.body)["error"]
+  end
+
   def test_image_upload_and_serving
     login
     get "/admin/posts/new"