Move upload caps into validation config env vars.

Replace MAX_IMAGES_PER_UPLOAD with VALIDATION_UPLOAD_* limits mirrored on the frontend VITE_* names.

backend/src/config/index.ts

@@ -49,6 +49,10 @@ export const getAppConfig = (): AppConfig => {
         uploadThrottle: {
             ttlMs: envInt('THROTTLE_UPLOAD_TTL_MS'),
             limit: envInt('THROTTLE_UPLOAD_LIMIT')
+        },
+        validation: {
+            maxImagesPerUpload: envInt('VALIDATION_UPLOAD_MAX_IMAGES_PER_UPLOAD'),
+            uploadMaxViewsMax: envInt('VALIDATION_UPLOAD_MAX_VIEWS_MAX')
         }
     };
 };

backend/src/config/validate.spec.ts

@@ -11,7 +11,7 @@ const validConfig = (overrides: Record<string, unknown> = {}): Record<string, un
     POSTGRES_PORT: 5432,
     POSTGRES_MIGRATIONS_RUN: 'false',
     CORS_ORIGINS: 'http://localhost:5173',
-    MAX_IMAGES_PER_UPLOAD: 10,
+    VALIDATION_UPLOAD_MAX_IMAGES_PER_UPLOAD: 10,
     MULTER_MAX_FILE_BYTES: 10485760,
     ALTCHA_ENABLED: 'true',
     ALTCHA_HMAC_KEY: 'secret',
@@ -21,6 +21,7 @@ const validConfig = (overrides: Record<string, unknown> = {}): Record<string, un
     THROTTLE_LIMIT: 1000,
     THROTTLE_UPLOAD_TTL_MS: 60000,
     THROTTLE_UPLOAD_LIMIT: 20,
+    VALIDATION_UPLOAD_MAX_VIEWS_MAX: 1_000_000,
     ...overrides
 });
 

backend/src/config/validate.ts

@@ -45,12 +45,6 @@ class EnvironmentVariables {
     @IsString()
     CORS_ORIGINS: string;
 
-    @IsNotEmpty()
-    @IsNumber()
-    @Min(1)
-    @Max(100)
-    MAX_IMAGES_PER_UPLOAD: number;
-
     @IsNotEmpty()
     @IsNumber()
     @Min(1)
@@ -100,6 +94,18 @@ class EnvironmentVariables {
     @Min(1)
     @Max(10_000)
     THROTTLE_UPLOAD_LIMIT: number;
+
+    @IsNotEmpty()
+    @IsNumber()
+    @Min(1)
+    @Max(100)
+    VALIDATION_UPLOAD_MAX_IMAGES_PER_UPLOAD: number;
+
+    @IsNotEmpty()
+    @IsNumber()
+    @Min(1)
+    @Max(10_000_000)
+    VALIDATION_UPLOAD_MAX_VIEWS_MAX: number;
 }
 
 export const validate = (config: Record<string, unknown>) => {