[SandObserver]

Summary

• Lower client_body_buffer_size on the /api/ location from 3m to 256k. nginx reads a whole request body before proxying, so a 3 MB in-memory buffer per request let slow unauthenticated uploads exhaust the container's 384 MB memory limit.
• 256k still holds a settings save in memory, so normal saves stay out of nginx temporary files.
• Replace the nginx config test with lower and upper bounds on the buffer.

Testing
All green, e2e included. The nginx config test now bounds the buffer between 128k and 512k.

Changelog

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.