[SECURITY][UPLOADS] Enforce streaming body limits before buffering KYC and vehicle files

[Obiajulu-gif]

Summary

Uploads trust an optional Content-Length check and then buffer the complete request with arrayBuffer(). Chunked or dishonest requests can consume unbounded memory before the post-read size check runs.

Repository evidence

• app/api/upload/route.ts only rejects the declared content length before reading.
• The route calls Buffer.from(await request.arrayBuffer()) for both KYC and vehicle uploads.

Scope

• Read through a byte-counting stream that aborts as soon as the per-scope limit is exceeded.
• Enforce server/runtime body limits independent of client headers.
• Keep MIME/signature validation and cleanup atomic on abort.

Acceptance criteria

• Chunked and understated uploads are terminated before exceeding the configured memory budget.
• Oversized uploads return 413 and create no blob/database record.
• Valid maximum-size uploads still pass scanning/encryption.

Tests

• Chunked, missing-header, understated-header, abort, and exact-boundary tests.
• Memory-bounded integration test for concurrent uploads.

Non-goals

• Changing allowed document types.