fix: disable default 2MB body limit on upload route

Axum's DefaultBodyLimit defaults to 2MB. Uploaded photos/videos exceed
this and were rejected with 400 before reaching the handler. Disable the
body limit on POST /api/v1/upload — size validation is already enforced
inside the handler via max_image_size_mb / max_video_size_mb config.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/src/main.rs

@@ -1,4 +1,5 @@
 use anyhow::Result;
+use axum::extract::DefaultBodyLimit;
 use axum::routing::{delete, get, patch, post};
 use axum::Router;
 use tower_http::services::ServeDir;
@@ -40,8 +41,9 @@ async fn main() -> Result<()> {
         .route("/api/v1/recover", post(auth::handlers::recover))
         .route("/api/v1/admin/login", post(auth::handlers::admin_login))
         .route("/api/v1/session", delete(auth::handlers::logout))
-        // Upload
-        .route("/api/v1/upload", post(handlers::upload::upload))
+        // Upload — body limit disabled; size validation is done inside the handler
+        .route("/api/v1/upload", post(handlers::upload::upload)
+            .route_layer(DefaultBodyLimit::disable()))
         .route(
             "/api/v1/upload/{id}",
             patch(handlers::upload::edit_upload).delete(handlers::upload::delete_upload),