feat: make all hardcoded limits configurable via env vars

- bodyLimit: conditional on MAX_UPLOAD_SIZE_MB (0 = 1GB practical max)
- rate limiting: disabled when RATE_LIMIT_PER_MIN=0
- shutdown timeout: 8s → 30s
- upload plugin: no fileSize/files cap when env=0
- session duration: configurable via SESSION_DURATION_HOURS (default 168h)
- login attempts: configurable via LOGIN_ATTEMPT_LIMIT
- batch/pipeline/svg-to-raster: skip guard when MAX_BATCH_SIZE=0
- pipeline steps: configurable via MAX_PIPELINE_STEPS (0 = unlimited)
- user-files: remove 200 hard cap
- stitch canvas: configurable via MAX_CANVAS_PIXELS (0 = unlimited)
- PDF pages: configurable via MAX_PDF_PAGES (0 = unlimited)
- SVG size: configurable via MAX_SVG_SIZE_MB (0 = unlimited)
- logo size: configurable via MAX_LOGO_SIZE_KB (default 2048)
- worker threads: auto-detect via resolveWorkerThreads (0 = auto)
- megapixels: skip validation when MAX_MEGAPIXELS=0
- seam carving: remove 1200px dimension cap
- concurrency: auto-detect via resolveConcurrency (0 = auto)

apps/api/src/lib/worker-pool.ts

@@ -4,15 +4,14 @@
  * Uses Piscina (backed by worker_threads) so Sharp operations don't block
  * HTTP request handling, SSE streams, or health checks.
  */
-import { availableParallelism } from "node:os";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import Piscina from "piscina";
+import { loadEnv, resolveWorkerThreads } from "./env.js";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
-// Size the pool: leave 1 thread for the event loop, min 1 worker
-const maxThreads = Math.max(1, Math.min(availableParallelism() - 1, 4));
+const maxThreads = resolveWorkerThreads(loadEnv());
 
 let pool: Piscina | null = null;