Harden uploads, request limits, and external calls

[1816x]

Summary

• disable document uploads by default while keeping the workspace visible and clearly locked
• enforce matching request, field, chunking, and search limits in FastAPI and Next.js
• time out Claude after 30 seconds with SDK retries disabled, returning an explicit 504
• close CORS by default and allow only configured exact origins
• expose upload state and active limits through /stats
• preserve backend 403, 413, 422, and 504 responses through the Next.js proxy
• document deployment flags and add hardening regression coverage

Deployment behavior

fly.toml explicitly keeps public uploads and CORS disabled. Startup corpus seeding still writes directly to the in-memory store. Enabling the upload UI or scripts/seed.py requires RAG_UPLOADS_ENABLED=1.

Validation

GitHub Actions runs:

• Rust formatting, clippy, and tests
• Python binding tests
• RAG service tests
• Next.js production build