feat(media): raise the upload cap to 90 MiB and stop buffering uploads in RAM

[ssavutu]

Why

The migrated WordPress corpus contains unresized camera originals well past the current 25 MiB cap — the largest is wp-content/uploads/2025/07/BZ9A5771.jpg at 76.3 MiB, with a dozen more in the 45–70 MiB range. Uploading files the newsroom already produces was a guaranteed 413.

What changed

Cap raised to 90 MiB (defaultMaxUploadBytes). The number is bounded above by Cloudflare's 100 MB request-body limit on the tunnel fronting Delta: a body that clears Nginx and the backend but exceeds that fails at the edge with an error the CMS never sees. Don't raise the pair past ~95 MiB without moving media uploads off the tunnel.

Uploads no longer buffer in RAM. ParseMultipartForm was being handed maxBytes, but that argument is the in-memory threshold, not the cap — MaxBytesReader has always been what enforces the cap. At 90 MiB that would have pinned a full upload's size in memory, plus the ~10 MiB of slack Go adds. It now gets a fixed 8 MiB and spills the rest to temp files. The write path already streams (io.Copy to a temp file, image.DecodeConfig reads headers only), so a large upload costs container disk, not memory.

Nginx client_max_body_size 26m → 91m, plus client_body_timeout / proxy_read_timeout / proxy_send_timeout at 300s so a 90 MiB upload over a slow uplink isn't killed mid-flight.

MEDIA_MAX_UPLOAD_BYTES is now plumbed through Compose and the env template. The backend read it but nothing passed it in, so the cap could previously only be changed by editing Go.

Tests

• 413 on an oversize body.
• A body 4× the memory threshold still parses — proves the spill path works and the cap doesn't fire early. This is the regression that would catch a future re-coupling of the two limits.
• maxUploadBytes default / env override / garbage fallback, with an assertion that the default stays ≥ 80 MiB so the corpus doesn't silently outgrow it again.

Full server suite passes.

Deploy note

Both halves must land together or the smaller limit silently wins:

1. Reinstall deploy/nginx/triangle-cms.conf on Delta, nginx -t, reload. The installed copy is known to drift from the repo.
2. Recreate the backend slots so they pick up MEDIA_MAX_UPLOAD_BYTES.

Delta today still shows client_max_body_size 26m and no MEDIA_MAX_UPLOAD_BYTES in the running containers.

🤖 Generated with Claude Code