feat: make all hardcoded limits configurable via env vars

- bodyLimit: conditional on MAX_UPLOAD_SIZE_MB (0 = 1GB practical max)
- rate limiting: disabled when RATE_LIMIT_PER_MIN=0
- shutdown timeout: 8s → 30s
- upload plugin: no fileSize/files cap when env=0
- session duration: configurable via SESSION_DURATION_HOURS (default 168h)
- login attempts: configurable via LOGIN_ATTEMPT_LIMIT
- batch/pipeline/svg-to-raster: skip guard when MAX_BATCH_SIZE=0
- pipeline steps: configurable via MAX_PIPELINE_STEPS (0 = unlimited)
- user-files: remove 200 hard cap
- stitch canvas: configurable via MAX_CANVAS_PIXELS (0 = unlimited)
- PDF pages: configurable via MAX_PDF_PAGES (0 = unlimited)
- SVG size: configurable via MAX_SVG_SIZE_MB (0 = unlimited)
- logo size: configurable via MAX_LOGO_SIZE_KB (default 2048)
- worker threads: auto-detect via resolveWorkerThreads (0 = auto)
- megapixels: skip validation when MAX_MEGAPIXELS=0
- seam carving: remove 1200px dimension cap
- concurrency: auto-detect via resolveConcurrency (0 = auto)

apps/api/src/routes/branding.ts

@@ -11,13 +11,14 @@ import { join } from "node:path";
 import { eq } from "drizzle-orm";
 import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
 import sharp from "sharp";
+import { env } from "../config.js";
 import { db, schema } from "../db/index.js";
 import { ensureSharpCompat } from "../lib/heic-converter.js";
 import { requireAdmin } from "../plugins/auth.js";
 
 const BRANDING_DIR = join(process.cwd(), "data", "branding");
 const LOGO_PATH = join(BRANDING_DIR, "logo.png");
-const MAX_LOGO_SIZE = 500 * 1024; // 500 KB
+const maxLogoSize = env.MAX_LOGO_SIZE_KB * 1024;
 
 function upsertSetting(key: string, value: string): void {
   const existing = db.select().from(schema.settings).where(eq(schema.settings.key, key)).get();
@@ -51,10 +52,11 @@ export async function brandingRoutes(app: FastifyInstance): Promise<void> {
     const buffer = await file.toBuffer();
 
     // Validate size
-    if (buffer.length > MAX_LOGO_SIZE) {
-      return reply
-        .status(400)
-        .send({ error: "Logo must be 500KB or smaller", code: "VALIDATION_ERROR" });
+    if (buffer.length > maxLogoSize) {
+      return reply.status(400).send({
+        error: `Logo must be ${env.MAX_LOGO_SIZE_KB}KB or smaller`,
+        code: "VALIDATION_ERROR",
+      });
     }
 
     // Decode HEIC/HEIF if needed, then convert to PNG, resize to max 128x128