feat: make all hardcoded limits configurable via env vars

- bodyLimit: conditional on MAX_UPLOAD_SIZE_MB (0 = 1GB practical max)
- rate limiting: disabled when RATE_LIMIT_PER_MIN=0
- shutdown timeout: 8s → 30s
- upload plugin: no fileSize/files cap when env=0
- session duration: configurable via SESSION_DURATION_HOURS (default 168h)
- login attempts: configurable via LOGIN_ATTEMPT_LIMIT
- batch/pipeline/svg-to-raster: skip guard when MAX_BATCH_SIZE=0
- pipeline steps: configurable via MAX_PIPELINE_STEPS (0 = unlimited)
- user-files: remove 200 hard cap
- stitch canvas: configurable via MAX_CANVAS_PIXELS (0 = unlimited)
- PDF pages: configurable via MAX_PDF_PAGES (0 = unlimited)
- SVG size: configurable via MAX_SVG_SIZE_MB (0 = unlimited)
- logo size: configurable via MAX_LOGO_SIZE_KB (default 2048)
- worker threads: auto-detect via resolveWorkerThreads (0 = auto)
- megapixels: skip validation when MAX_MEGAPIXELS=0
- seam carving: remove 1200px dimension cap
- concurrency: auto-detect via resolveConcurrency (0 = auto)

apps/api/src/index.ts

@@ -41,7 +41,7 @@ recoverInterruptedInstalls();
 
 const app = Fastify({
   logger: { level: env.LOG_LEVEL },
-  bodyLimit: env.MAX_UPLOAD_SIZE_MB * 1024 * 1024,
+  bodyLimit: env.MAX_UPLOAD_SIZE_MB > 0 ? env.MAX_UPLOAD_SIZE_MB * 1024 * 1024 : 1073741824,
 });
 
 app.setErrorHandler((error: Error & { statusCode?: number }, request, reply) => {
@@ -79,12 +79,13 @@ app.addHook("onSend", async (_request, reply) => {
   }
 });
 
-await app.register(rateLimit, {
-  max: env.RATE_LIMIT_PER_MIN,
-  timeWindow: "1 minute",
-  // Only rate-limit API endpoints — static files and the SPA fallback must never be throttled
-  allowList: (request) => !request.url.startsWith("/api/"),
-});
+if (env.RATE_LIMIT_PER_MIN > 0) {
+  await app.register(rateLimit, {
+    max: env.RATE_LIMIT_PER_MIN,
+    timeWindow: "1 minute",
+    allowList: (request) => !request.url.startsWith("/api/"),
+  });
+}
 
 // Multipart upload support
 await registerUpload(app);
@@ -195,7 +196,7 @@ try {
 }
 
 // Graceful shutdown
-const SHUTDOWN_TIMEOUT_MS = 8000;
+const SHUTDOWN_TIMEOUT_MS = 30000;
 let shuttingDown = false;
 async function shutdown(signal: string) {
   if (shuttingDown) return;