feat(attach): 附件可配置限额、流式落盘与分阶段上传

管理端可配类型/体积；上传改流式避免整文件进内存；发帖先选再传并拦截未上传提交；提高 Next proxy 体积上限。

Co-authored-by: Cursor <cursoragent@cursor.com>

frontend/app/admin/settings/SettingsAdmin.tsx

@@ -15,17 +15,26 @@ import {
   Wrench,
   Palette,
   FileText,
+  Paperclip,
+  Image as ImageIcon,
 } from "lucide-react";
-import { useEffect, useState, type ReactNode } from "react";
+import { useEffect, useMemo, useRef, useState, type ReactNode } from "react";
 import {
+  AdminExtChipEditor,
   AdminField,
   AdminPageHeader,
   AdminSection,
+  AdminStepper,
   AdminSwitch,
 } from "@/components/admin";
 import { apiUpdateSiteSettings, type PublicSettings } from "@/lib/api";
 import { toast } from "@/lib/toast";
 
+function extsEqual(a: string[], b: string[]) {
+  if (a.length !== b.length) return false;
+  return a.every((v, i) => v === b[i]);
+}
+
 type SectionId =
   | "basic"
   | "content"
@@ -119,7 +128,18 @@ export default function SettingsAdmin({ initial }: { initial: PublicSettings })
   const [togglingLink, setTogglingLink] = useState(false);
   const [active, setActive] = useState<SectionId>("basic");
 
+  const [extLimit, setExtLimit] = useState(initial.attachment_ext_limit !== false);
+  const [exts, setExts] = useState<string[]>(() => [...(initial.attachment_exts || [])]);
+  const [savedExts, setSavedExts] = useState<string[]>(() => [...(initial.attachment_exts || [])]);
+  const [attMaxMB, setAttMaxMB] = useState(initial.attachment_max_mb || 20);
+  const [attMaxCount, setAttMaxCount] = useState(initial.attachment_max_count || 10);
+  const [imageMaxMB, setImageMaxMB] = useState(initial.image_max_mb || 5);
+  const [togglingExtLimit, setTogglingExtLimit] = useState(false);
+  const [savingLimits, setSavingLimits] = useState(false);
+  const [savingExts, setSavingExts] = useState(false);
+
   const dirty = siteName.trim() !== savedName || siteDescription.trim() !== savedDesc;
+  const extsDirty = useMemo(() => !extsEqual(exts, savedExts), [exts, savedExts]);
 
   useEffect(() => {
     const ids = NAV.map((n) => n.id);
@@ -232,6 +252,75 @@ export default function SettingsAdmin({ initial }: { initial: PublicSettings })
     }
   };
 
+  const toggleExtLimit = async () => {
+    if (togglingExtLimit) return;
+    const next = !extLimit;
+    setTogglingExtLimit(true);
+    try {
+      const res = await apiUpdateSiteSettings({ attachment_ext_limit: next });
+      setExtLimit(res.attachment_ext_limit !== false);
+      toast(res.attachment_ext_limit !== false ? "已开启附件类型限制" : "已关闭附件类型限制", "ok");
+    } catch (e) {
+      toast(e instanceof Error ? e.message : "保存失败");
+    } finally {
+      setTogglingExtLimit(false);
+    }
+  };
+
+  const saveUploadLimits = async (patch: {
+    attachment_max_mb?: number;
+    attachment_max_count?: number;
+    image_max_mb?: number;
+  }) => {
+    if (savingLimits) return;
+    setSavingLimits(true);
+    try {
+      const res = await apiUpdateSiteSettings(patch);
+      setAttMaxMB(res.attachment_max_mb);
+      setAttMaxCount(res.attachment_max_count);
+      setImageMaxMB(res.image_max_mb);
+      toast("上传限额已保存", "ok");
+    } catch (e) {
+      toast(e instanceof Error ? e.message : "保存失败");
+    } finally {
+      setSavingLimits(false);
+    }
+  };
+
+  // 步进器手输会连续触发 onChange，防抖后再写库
+  const limitsTimer = useRef<ReturnType<typeof setTimeout> | null>(null);
+  const scheduleLimitSave = (patch: {
+    attachment_max_mb?: number;
+    attachment_max_count?: number;
+    image_max_mb?: number;
+  }) => {
+    if (limitsTimer.current) clearTimeout(limitsTimer.current);
+    limitsTimer.current = setTimeout(() => {
+      void saveUploadLimits(patch);
+    }, 450);
+  };
+
+  useEffect(() => {
+    return () => {
+      if (limitsTimer.current) clearTimeout(limitsTimer.current);
+    };
+  }, []);
+
+  const saveExts = async () => {
+    if (savingExts || !extsDirty) return;
+    setSavingExts(true);
+    try {
+      const res = await apiUpdateSiteSettings({ attachment_exts: exts });
+      setExts([...res.attachment_exts]);
+      setSavedExts([...res.attachment_exts]);
+      toast("附件扩展名已保存", "ok");
+    } catch (e) {
+      toast(e instanceof Error ? e.message : "保存失败");
+    } finally {
+      setSavingExts(false);
+    }
+  };
+
   return (
     <div>
       <AdminPageHeader
@@ -310,7 +399,7 @@ export default function SettingsAdmin({ initial }: { initial: PublicSettings })
             </AdminSection>
           </div>
 
-          <div id="settings-content" className="scroll-mt-4">
+          <div id="settings-content" className="scroll-mt-4 flex flex-col gap-4">
             <AdminSection title="内容与互动" description="控制注册、评论、消息与链接打开方式">
               <SwitchRow
                 bordered
@@ -380,6 +469,137 @@ export default function SettingsAdmin({ initial }: { initial: PublicSettings })
                 }
               />
             </AdminSection>
+
+            <AdminSection
+              title="附件与上传"
+              description="帖子附件限额、扩展名白名单与正文插图体积；改后经实时通道同步到发帖页"
+            >
+              <SwitchRow
+                bordered
+                title={
+                  <>
+                    <Paperclip size={15} /> 附件单文件上限
+                  </>
+                }
+                description="发帖附件体积上限。过大可能拖垮进程，并须把反代 / Next 请求体上限调到不少于该值。"
+                control={
+                  <AdminStepper
+                    value={attMaxMB}
+                    min={1}
+                    max={999999}
+                    unit="MB"
+                    ariaLabel="附件单文件上限"
+                    disabled={savingLimits}
+                    onChange={(n) => {
+                      setAttMaxMB(n);
+                      scheduleLimitSave({ attachment_max_mb: n });
+                    }}
+                  />
+                }
+              />
+              {attMaxMB >= 50 ? (
+                <p className="j13-ext-warn !mt-0 !mb-3" role="status">
+                  当前 ≥50MB：请确认服务器内存与反代 body 上限已同步调大，否则用户仍会先撞上网关 413。
+                </p>
+              ) : null}
+
+              <SwitchRow
+                bordered
+                title={
+                  <>
+                    <Paperclip size={15} /> 每帖附件个数
+                  </>
+                }
+                description="单帖（含草稿）最多可绑定的附件数量。"
+                control={
+                  <AdminStepper
+                    value={attMaxCount}
+                    min={1}
+                    max={20}
+                    unit="个"
+                    ariaLabel="每帖附件个数"
+                    disabled={savingLimits}
+                    onChange={(n) => {
+                      setAttMaxCount(n);
+                      scheduleLimitSave({ attachment_max_count: n });
+                    }}
+                  />
+                }
+              />
+
+              <SwitchRow
+                bordered
+                title={
+                  <>
+                    <ImageIcon size={15} /> 正文插图上限
+                  </>
+                }
+                description="Markdown 拖拽/粘贴图片（仅 JPEG / PNG / WebP）。插图会在服务端解析头部。"
+                control={
+                  <AdminStepper
+                    value={imageMaxMB}
+                    min={1}
+                    max={999999}
+                    unit="MB"
+                    ariaLabel="正文插图上限"
+                    disabled={savingLimits}
+                    onChange={(n) => {
+                      setImageMaxMB(n);
+                      scheduleLimitSave({ image_max_mb: n });
+                    }}
+                  />
+                }
+              />
+              {imageMaxMB >= 10 ? (
+                <p className="j13-ext-warn !mt-0 !mb-3" role="status">
+                  插图 ≥10MB：解码头部更耗内存，建议保持较小值。
+                </p>
+              ) : null}
+
+              <SwitchRow
+                bordered
+                title={
+                  <>
+                    <Paperclip size={15} /> 限制附件扩展名
+                  </>
+                }
+                description={
+                  extLimit
+                    ? "仅允许下方列表中的扩展名；安装包 / 脚本 / 网页可按需保留。"
+                    : "任意格式可传，仍受体积上限与下载沙箱约束。"
+                }
+                control={
+                  <AdminSwitch
+                    checked={extLimit}
+                    disabled={togglingExtLimit}
+                    onChange={() => void toggleExtLimit()}
+                    label="限制附件扩展名"
+                  />
+                }
+              />
+
+              <div className="pt-2">
+                <p className="text-[13.5px] font-medium mb-2" style={{ color: "var(--ink)" }}>
+                  允许的扩展名
+                </p>
+                <AdminExtChipEditor
+                  value={exts}
+                  onChange={setExts}
+                  disabled={!extLimit || savingExts}
+                />
+                <div className="flex justify-end mt-3">
+                  <button
+                    type="button"
+                    className="btn btn-primary btn-sm"
+                    disabled={!extsDirty || savingExts || !extLimit}
+                    onClick={() => void saveExts()}
+                  >
+                    {savingExts ? <Loader2 size={14} className="animate-spin" /> : <Save size={14} />}
+                    保存扩展名
+                  </button>
+                </div>
+              </div>
+            </AdminSection>
           </div>
 
           <div id="settings-brand" className="scroll-mt-4">