task ha: enforce upload limits, role checks, probing, thumbnails, cleanup

- handlers.go: enforce MAX_UPLOAD_SIZE_MB via http.MaxBytesReader and
  http.MaxBytesError mapping to 413.
- service/media.go: UploadMedia now verifies owner/admin, rejects unsupported
  extensions, probes metadata with ffprobe, generates video thumbnails,
  enforces unique filenames, and cleans up temp files + hard-deletes DB row
  on any failure.
- Reconcile PLAN.md 500MB -> 100MB default to match AGENTS.md/config.
- Add service and API tests for max-size rejection, unsupported extension,
  missing role, probe failure, thumbnail failure, cleanup, and success paths.

0 files changed, 0 insertions, 0 deletions