fix(control-plane): make max upload size configurable (#2313)

[nicoloboschi]

Problem

Fixes #2313. Uploading a single file larger than 10MB via the Control Plane silently fails — the dialog never closes and the logs show:

Request body exceeded 10MB for /api/files/retain. Only the first 10MB will be available unless configured.
Error uploading files: TypeError: Failed to parse body as FormData.

Root cause

This is the Control Plane (Next.js), not the dataplane. The auth middleware sits in front of /api/files/retain, so Next.js buffers the proxied request body and truncates anything over its default 10MB limit (DEFAULT_BODY_CLONE_SIZE_LIMIT, configured via proxyClientMaxBodySize). The route then tries to parse a truncated multipart body and throws Failed to parse body as FormData, so the request never reaches the dataplane.

The dataplane already allows 100MB and is already configurable (HINDSIGHT_API_FILE_CONVERSION_MAX_BATCH_SIZE_MB), so the Control Plane was the lone bottleneck.

Fix

Set Next's experimental.proxyClientMaxBodySize in next.config.ts:

• Default raised to 100mb, matching the dataplane's HINDSIGHT_API_FILE_CONVERSION_MAX_BATCH_SIZE_MB default.
• Configurable via the new HINDSIGHT_CP_MAX_UPLOAD_SIZE env var — accepts a size string (100mb, 1gb) or a raw byte count.

Note: installed Next is 16.2.9, where the canonical key is proxyClientMaxBodySize (the older middlewareClientMaxBodySize alias is still in the schema but is no longer read).

Verification

• Loaded the config through Next's own loadConfig + zod validation: default 100mb → 104857600 bytes, override 250mb → 262144000, raw byte counts pass through. No validation errors or unknown-key warnings.
• tsc --noEmit and ./scripts/hooks/lint.sh pass.

Docs

Added HINDSIGHT_CP_MAX_UPLOAD_SIZE to the Control Plane table in developer/configuration.md.

[g-radam]

You beat me to submitting a PR. Thank you! :)

Can confirm this patch fixes the issue (tested locally).