Security: bound API-owned image uploads

[tyl-droid]

Closes the remaining API upload-limit gap identified after #54.

The saved-image and custom-avatar-item routes accepted authenticated multipart files without a per-file ceiling. This change adds RECFLARE_MAX_API_UPLOAD_BYTES with a safe 64 MiB default and returns HTTP 413 before oversized parsed files are copied into ArrayBuffers or written to R2.

Coverage includes:

• Oversized saved-image rejection
• Oversized custom-avatar thumbnail rejection
• Oversized custom-avatar design rejection
• Verification that rejected requests leave no R2 objects or database metadata
• OpenAPI, deployment configuration and operator documentation
• Comments explaining the security boundary and remaining multipart limitation

Validation:

• 292/292 API tests passed
• API TypeScript check passed
• API lint passed
• git diff --check passed

Multipart parsing still occurs before the per-file check. An edge request-body ceiling or streaming parser remains the complete defense against initial parsing memory pressure.

[djdevin]

Thanks, I actually saw this gap and was going to work on it afterwards, lol