admin: configurable file browser upload size limit (#12348)

* admin: carry a file browser upload size limit

The admin server keeps the total size limit of one file browser upload, 500 MB by default as the UI enforced before, and hands it to the file browser page.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* admin: reject file browser uploads over the size limit

The 500 MB limit was only checked in the browser, so any client could post larger uploads and fill the temp dir with spooled parts. Cap the request body at the limit plus room for the multipart framing, and answer 413 when the files add up to more than the limit.

Parse the form before reading the path field. FormValue used to parse it first with the default 32 MB memory, which made the later 1 GB ParseMultipartForm a no-op; keep 32 MB explicitly.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* admin: show and check the configured upload limit in the file browser

The upload dialog reads the limit from the page instead of a hard-coded 500 MB, lists it under the file picker, and skips the check when uploads are unlimited.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* admin: add -uploadMaxSizeMB to set the file browser upload limit

weed admin -uploadMaxSizeMB and weed mini -admin.uploadMaxSizeMB set the total size limit of one file browser upload; 0 removes it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* admin: note why the upload framing allowance is enough

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* admin: test an upload whose files only exceed the limit together

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* admin: remove spooled upload parts when the upload handler returns

Parts over 32 MB spool to temp files. The router passes the handler a copy of the request, so net/http never sees the parsed form and never removes those files. Every large upload, and every one rejected for size after parsing, left them on disk.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

weed/admin/dash/admin_server.go

@@ -175,8 +175,14 @@ type AdminServer struct {
 	// s3PublicEndpoint is the client-facing S3 address from admin.toml
 	// (s3.public_endpoint); discovered S3 servers are the fallback.
 	s3PublicEndpoint string
+
+	// uploadMaxSize caps the total bytes of one file browser upload; 0 means no limit.
+	uploadMaxSize int64
 }
 
+// DefaultUploadMaxSizeMB is the default total size limit of one file browser upload.
+const DefaultUploadMaxSizeMB = 500
+
 // Type definitions moved to types.go
 
 func NewAdminServer(masters string, filerGroup string, templateFS http.FileSystem, dataDir string, icebergPort, lancePort int, s3PublicEndpoint string) *AdminServer {
@@ -217,6 +223,7 @@ func NewAdminServer(masters string, filerGroup string, templateFS http.FileSyste
 		icebergPort:                   icebergPort,
 		lancePort:                     lancePort,
 		s3PublicEndpoint:              normalizeS3PublicEndpoint(s3PublicEndpoint),
+		uploadMaxSize:                 DefaultUploadMaxSizeMB << 20,
 		pluginLock:                    lockManager,
 		adminPresenceLock:             presenceLock,
 		bgCancel:                      bgCancel,
@@ -1574,6 +1581,18 @@ func (s *AdminServer) GetS3Endpoint() string {
 	return s.s3PublicEndpoint
 }
 
+// SetUploadMaxSize sets the total size limit in bytes of one file browser
+// upload; zero or less removes the limit.
+func (s *AdminServer) SetUploadMaxSize(maxBytes int64) {
+	s.uploadMaxSize = max(maxBytes, 0)
+}
+
+// GetUploadMaxSize returns the total size limit in bytes of one file browser
+// upload, or 0 when uploads are unlimited.
+func (s *AdminServer) GetUploadMaxSize() int64 {
+	return s.uploadMaxSize
+}
+
 // normalizeS3PublicEndpoint trims a trailing slash and drops, with a warning,
 // a value that is not a plain absolute http or https URL, so the file browser
 // hides its URL actions instead of copying broken links. Checking the string