Add admin config page and runtime-tunable upload/rate-limit settings

internal/config/defaults.go

@@ -0,0 +1,23 @@
+package config
+
+const (
+	KeyUploadMaxFileSizeBytes   = "upload.max_file_size_bytes"
+	KeyUploadMultiMaxFiles      = "upload.multi.max_files"
+	KeyUploadMaxHours           = "upload.max_hours"
+	KeyRateLimitLoginPerMinute  = "ratelimit.login.per_minute"
+	KeyRateLimitApiPerMinute    = "ratelimit.api.per_minute"
+	KeyRateLimitApiBurst        = "ratelimit.api.burst"
+	KeyRateLimitLoginBurst      = "ratelimit.login.burst"
+)
+
+// Defaults (used when DB does not have an override)
+const (
+	DefaultUploadMaxFileSizeBytes int64 = 10 << 30 // 10 GiB (matches MaxMultipartMemory intent)
+	DefaultUploadMultiMaxFiles          = 50
+	DefaultUploadMaxHours               = 24 * 7 // 7 days
+
+	DefaultRateLimitLoginPerMinute = 5
+	DefaultRateLimitLoginBurst     = 10
+	DefaultRateLimitApiPerMinute   = 60
+	DefaultRateLimitApiBurst       = 30
+)