feat: security hardening (filename sanitization, bucket validation, file size enforcement)

[roninscript30]

🔐 Summary

This PR introduces critical security improvements to the upload system by addressing multiple backend validation and safety gaps:

• Filename sanitization to prevent unsafe file paths (Sanitize and normalize uploaded filenames before storage/use #11)
• S3 bucket public access validation (Validate S3 bucket public-access block during credential setup #13)
• Backend file size enforcement for multipart uploads (Enforce API-level maximum file size on multipart upload initiation #14)

These changes ensure the system is resilient against misuse, unsafe configurations, and malicious input.

---

✅ Changes

🧩 Filename Sanitization (#11)

• Implemented secure filename normalization utility
• Removed path traversal patterns (../, ..\\)
• Restricted characters to safe set [a-zA-Z0-9._-]
• Replaced unsafe characters with _
• Enforced filename length limit
• Applied sanitization before storing in MongoDB and uploading to S3

---

🔐 S3 Bucket Validation (#13)

• Added validation during bucket setup using AWS SDK
• Checked get_public_access_block and bucket policy status
• Rejected buckets with public access enabled
• Returned clear error messages to frontend

---

📦 File Size Enforcement (#14)

• Added backend validation for file size during upload initiation
• Introduced configurable MAX_FILE_SIZE via environment variable
• Rejected oversized uploads with HTTP 413 response
• Prevented bypassing frontend validation

---

🧪 Testing

Filename Sanitization

• Tested with malicious inputs (../../, unicode spoofing, special characters)
• Verified safe filenames in MongoDB and S3

Bucket Validation

• Verified secure bucket passes validation
• Verified public bucket is rejected with proper error

File Size Enforcement

• Valid file sizes upload successfully
• Oversized files rejected at API level
• Confirmed protection against direct API bypass

---

🎯 Impact

• Prevents path traversal and unsafe file handling
• Ensures uploaded data is stored only in secure S3 buckets
• Protects backend from oversized upload abuse
• Strengthens overall system security and reliability

---

Closes #11
Closes #13
Closes #14