test(loadtest): audit which real files the upload validator actually refuses

"Will my photos be accepted?" was being answered by reasoning about the size
caps, which is the wrong method — size is only one of the paths that refuses a
file. The magic-byte allowlist, the decode budget (12000 px axis / 256 MiB
alloc, both code constants no setting can relax), the disk gate and the per-user
quota all reject too, and only the running server knows how they interact.

`acceptance-audit.mjs` pushes every file in the pool through the real endpoint
and groups the refusals by the server's own German message. Against the 945-file
wedding set with the raised limits it answered the question exactly: 935
accepted, and the only 10 refusals are the HEIC files.

Deliberately not a load test — no personas, no viewers, no think-time. It
measures admission, so it does not wait for the compression backlog to drain.

The sim stack gains two overridable vars, so the harness can be pointed at the
configuration actually deployed rather than the defaults: SIM_APP_IMAGE /
SIM_FE_IMAGE (audit a release image, not a local build) and KEEPSAKE_ENABLED,
which changes the disk gate and therefore changes what gets refused.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

e2e/docker-compose.sim.yml

@@ -82,6 +82,8 @@ services:
       COMPRESSION_WORKER_CONCURRENCY: '2'
       # Production disables comments for this event (docker-compose.yml, product decision).
       COMMENTS_ENABLED: 'false'
+      # Mirrors the deployed setting so the harness can audit against the real gate.
+      KEEPSAKE_ENABLED: ${SIM_KEEPSAKE:-true}
       # The ONE deviation from production: enables /admin/__truncate so the harness can
       # reset between runs. Never set on the real box.
       EVENTSNAP_TEST_MODE: '1'
@@ -102,7 +104,7 @@ services:
 
   frontend:
     # Shipped release image; `git diff v0.17.6 HEAD -- frontend/` is empty.
-    image: registry.mc02.dev/eventsnap/frontend:v0.17.6
+    image: ${SIM_FE_IMAGE:-registry.mc02.dev/eventsnap/frontend:v0.17.6}
     cpuset: *cpuset
     depends_on:
       - app