feat(attach): 附件可配置限额、流式落盘与分阶段上传

管理端可配类型/体积；上传改流式避免整文件进内存；发帖先选再传并拦截未上传提交；提高 Next proxy 体积上限。

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/handler/upload.go

@@ -53,15 +53,43 @@ func (h *Handlers) UploadAvatar(c *gin.Context) {
 func (h *Handlers) UploadImage(c *gin.Context) {
 	claims := middleware.CurrentUser(c)
 
-	c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, service.ImageMaxBytes+4096)
+	maxBytes, err := h.Setting.ImageMaxBytes()
+	if err != nil || maxBytes < 1 {
+		maxBytes = service.ImageMaxBytes
+	}
+	overhead := int64(4096)
+	limit := maxBytes + overhead
+
+	if c.Request.ContentLength > limit {
+		mb := int(maxBytes >> 20)
+		if mb < 1 {
+			mb = 1
+		}
+		c.JSON(http.StatusRequestEntityTooLarge, gin.H{"error": "图片不能超过 " + strconv.Itoa(mb) + "MB"})
+		return
+	}
+	c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, limit)
 
 	fh, err := c.FormFile("file")
 	if err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "图片过大（不能超过 5MB）或格式不正确"})
+		var maxErr *http.MaxBytesError
+		if errors.As(err, &maxErr) {
+			mb := int(maxBytes >> 20)
+			if mb < 1 {
+				mb = 1
+			}
+			c.JSON(http.StatusRequestEntityTooLarge, gin.H{"error": "图片不能超过 " + strconv.Itoa(mb) + "MB"})
+			return
+		}
+		c.JSON(http.StatusBadRequest, gin.H{"error": "图片过大或格式不正确"})
 		return
 	}
-	if fh.Size > service.ImageMaxBytes {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "图片不能超过 5MB"})
+	if fh.Size > maxBytes {
+		mb := int(maxBytes >> 20)
+		if mb < 1 {
+			mb = 1
+		}
+		c.JSON(http.StatusBadRequest, gin.H{"error": "图片不能超过 " + strconv.Itoa(mb) + "MB"})
 		return
 	}
 	f, err := fh.Open()
@@ -71,18 +99,17 @@ func (h *Handlers) UploadImage(c *gin.Context) {
 	}
 	defer f.Close()
 
-	data, err := io.ReadAll(io.LimitReader(f, service.ImageMaxBytes+1))
-	if err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "读取图片失败"})
-		return
-	}
-	if len(data) > service.ImageMaxBytes {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "图片不能超过 5MB"})
-		return
-	}
-
-	att, err := h.Upload.SaveImage(claims.ID, data)
+	att, err := h.Upload.SaveImage(claims.ID, f)
 	if err != nil {
+		var maxErr *http.MaxBytesError
+		if errors.As(err, &maxErr) {
+			mb := int(maxBytes >> 20)
+			if mb < 1 {
+				mb = 1
+			}
+			c.JSON(http.StatusRequestEntityTooLarge, gin.H{"error": "图片不能超过 " + strconv.Itoa(mb) + "MB"})
+			return
+		}
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}