Enforce upload size limit on /api/metadata body and harden Content-Length parsing

[emiribrahimm]

Fixes #448

Problem

/api/metadata only checked the Content-Length header for upload size, so chunked uploads without that header could exceed the limit. Additionally, check_upload_size raised an unhandled ValueError (500) on non-numeric or negative Content-Length values.

Fix

Replaced the unbounded shutil.copyfileobj in the /api/metadata spool step with a chunked read that raises 413 once MAX_UPLOAD_BYTES is exceeded and removes the partial temp file on failure. Made check_upload_size return HTTP 400 for non-numeric or negative Content-Length instead of propagating ValueError.

Tests

• Added a regression test in tests/test_upload_size_guard.py that fails before this change and passes after it.
• The existing test suite passes locally.

[github-actions]

Thanks for the first pull request here. CI needs a maintainer to approve the run before it starts, so it may sit for a bit before anything happens. pytest tests/ -q passing is the main thing I look at.