fix(uploads): make both caps answerable, and stop holding a connection

The epic-end deep review found three defects in P1 and four tests that did not
hold what they claimed. They land together because they share the upload route
and its test module; splitting by hunk would have produced commits that do not
individually run green.

* The edge ceiling and the route's own cap are the SAME number at the default
  configuration, so the edge always answers first: a declared Content-Length
  over the cap is refused before a byte is read, and an undeclared body trips
  the middleware on the same chunk the route would have tripped on. The route's
  numbered 422 -- and the drain written for it last week -- are reachable only
  once an admin LOWERS the knob, which is the one shape the browser UAT tested.
  Measured: headroom does not fix this, because the declared-length check fires
  first for any body big enough to matter and the drain pushes the count back
  over the edge for the rest. So the edge's own refusal is made readable
  instead: `errors.tooLarge` localizes `too_large` the way `upload_too_large`
  was already localized, and the dialog refuses an over-cap file BEFORE sending
  it, off the `upload_max_bytes` that GET /api/downloads/usage now reports.
  Measured in Chrome against the API directly: that 413 arrives as `onload`
  with a readable body in 43 ms.

* Reading the body behind the auth dependency put the whole transfer inside the
  request's database session -- the auth SELECT autobegins a transaction, so one
  of the twenty pooled connections sat `idle in transaction`, with nothing to
  time it out, for as long as the client cared to keep sending. That is the
  invariant db.py sizes the pool on and plex/playback.py records an incident
  for. The read transaction now ends before the await. Measured on the dev
  server: an 1818 ms upload shows no idle-in-transaction sample while the bytes
  move, only afterwards, when the handler actually writes.

* The display name moved into a request header, where nothing bounds its length,
  while the column stayed varchar(255) -- so a long enough name was a DataError
  500 after the whole file had already transferred. One `display_text` helper
  now serves all three writers (the metadata PATCH already truncated, the upload
  ingest did not), and the dialog stops at the same number.

* The gate invariant asked `route.dependant.body_params`, which holds only the
  route's OWN callable's parameters: a body declared in a SUB-DEPENDENCY -- the
  upload route's own idiom -- leaves it empty while FastAPI still reads the body
  before auth. It asks `route.body_field` now, which is what FastAPI itself
  consults. The AST registry of body-reading call sites had also never followed
  `capped_stream_to`, so the one route the whole invariant exists for was the
  single site the drift guard could not see.

Four tests that passed over their own mutation are fixed: the cap boundary (a
`>` loosened to `>=` survived the entire suite), the percent-decoding (every
filename the suite sends is ASCII, where quote() is the identity function), the
display-name header (no test at all), and the staging cleanup (deleting the
unlink left the suite green while every refused upload leaked its partial bytes
onto the volume). Every test added or changed here was mutation-checked.

frontend/src/components/UploadDialog.tsx

@@ -1,10 +1,11 @@
 import { useEffect, useRef, useState } from "react";
 import { useTranslation } from "react-i18next";
-import { useQueryClient } from "@tanstack/react-query";
+import { useQuery, useQueryClient } from "@tanstack/react-query";
 import { UploadCloud, File as FileIcon } from "lucide-react";
 import Modal from "./ui/Modal";
 import { Button } from "./ui/Button";
 import { api } from "../lib/api";
+import { qk } from "../lib/queryKeys";
 import { isAborted } from "../lib/api/core";
 import { notifyActionError } from "../lib/actionErrors";
 import { invalidateDownloads } from "../lib/downloads";
@@ -31,6 +32,14 @@ export default function UploadDialog({ onClose }: { onClose: () => void }) {
   // plain boolean flickers. Count enter vs leave and only clear the highlight at depth 0.
   const dragDepth = useRef(0);
   const busy = pct !== null;
+  // The per-file cap, so an over-cap file is refused HERE instead of after the user has pushed it up
+  // the wire. Both server-side caps are still the boundary — this is only the pleasant half of it.
+  // On a default install the one that answers is the edge ceiling (`bodylimit`), whose refusal
+  // carries no number, so without this the user would be told "too large" and not what the limit is.
+  // A cap that has not loaded yet blocks nothing — the server still refuses, honestly.
+  const cap = useQuery({ queryKey: qk.downloadUsage(), queryFn: api.downloadUsage }).data
+    ?.upload_max_bytes;
+  const tooBig = !!file && !!cap && file.size > cap;
 
   // Closing the dialog mid-upload (X / ESC / backdrop / browser Back all unmount us) must abort the
   // in-flight XHR — otherwise it keeps streaming in the background and still toasts success. Only the
@@ -40,7 +49,7 @@ export default function UploadDialog({ onClose }: { onClose: () => void }) {
   const pick = () => inputRef.current?.click();
 
   const submit = async () => {
-    if (!file || busy) return;
+    if (!file || busy || tooBig) return;
     const ac = new AbortController();
     abortRef.current = ac;
     setPct(0);
@@ -133,6 +142,12 @@ export default function UploadDialog({ onClose }: { onClose: () => void }) {
         }}
       />
 
+      {tooBig && (
+        <p className="text-xs text-danger mt-2" role="alert">
+          {t("downloads.errors.upload.tooLarge", { size: formatBytes(cap ?? 0) })}
+        </p>
+      )}
+
       <label className="block text-sm font-medium mt-4 mb-1">
         {t("downloads.upload.nameLabel")}
       </label>
@@ -141,6 +156,9 @@ export default function UploadDialog({ onClose }: { onClose: () => void }) {
         onChange={(e) => setName(e.target.value)}
         placeholder={t("downloads.upload.namePlaceholder")}
         disabled={busy}
+        // The column behind it is varchar(255) and the name rides in a REQUEST HEADER, where nothing
+        // else bounds it; the server truncates to the same number (downloads.service.display_text).
+        maxLength={255}
         className={`${inputCls} mb-5`}
       />
 
@@ -175,7 +193,7 @@ export default function UploadDialog({ onClose }: { onClose: () => void }) {
         >
           {t("downloads.actions.cancel")}
         </Button>
-        <Button variant="primary" size="sm" onClick={submit} disabled={!file || busy}>
+        <Button variant="primary" size="sm" onClick={submit} disabled={!file || busy || tooBig}>
           {t("downloads.upload.submit")}
         </Button>
       </div>