Response to review findings

Updated to reflect commits landed on this branch.

Addressed

Structural change (a8515445)

The size/mime constraint moved off the controller and back onto the entity via a custom App\Validator\MediaFile constraint + validator (the API Platform MinimalProperties pattern). The controller now calls $this->validator->validate($media) against the assembled entity; the validator reads MEDIA_MAX_UPLOAD_SIZE_MB via DI. Restores the entity as the single source of truth for upload invariants and removes the inline new Assert\File(...) from the controller. Also dropped the redundant env(MEDIA_MAX_UPLOAD_SIZE_MB): '200' parameter fallback in services.yaml — .env is the sole default, consistent with how other env-driven params are handled.

Reclassified after investigation

• MediaController.php:30 — no handling of UPLOAD_ERR_INI_SIZE / UPLOAD_ERR_FORM_SIZE. Original finding was overstated. Symfony's Assert\File already branches on UploadedFile::getError() and emits a specific violation for every PHP upload error code (vendor/symfony/validator/Constraints/FileValidator.php:54-116); our MediaFileValidator delegates to it, so the upload_max_filesize case surfaces as a 422 with a clear "file is too large" message for free. Only post_max_size remains uncovered — PHP discards the body before Symfony's kernel runs, so there's no UploadedFile for any validator to inspect. With the PR's defaults (PHP-FPM ≥ nginx ≥ app at 200 MiB), nginx is the strictest layer and rejects with 413 before PHP runs, making this hard to hit in practice. Leaving the misleading "file is required" 400 for the narrow post_max_size case as a known gap.

Downgraded

• docker-compose.yml:72 — NGINX_MAX_BODY_SIZE: 5M — confirmed dev-only stack. Production runs the image built from infrastructure/nginx/Dockerfile whose NGINX_MAX_BODY_SIZE=200m default is already aligned. Local dev value is a dev-UX inconvenience for testing the new feature locally, not a release blocker.

Not addressed (deferred / out of scope)

Listed for tracking. Happy to pull any of these into this PR if you'd like:

• MediaTest.php:169 — skip-gate reads $_ENV directly. Silent skip if dotenv isn't populated. Should read via container/parameter instead.
• MediaController — 200Mi (binary) vs historical 200000k (decimal) ≈ 4.86% looser default. Worth either a CHANGELOG note or switching to 200M.
• file-dropzone.jsx:29 — error message mixes decimal MB display (/1000000) with binary MiB threshold (*1024*1024). Near boundary yields self-contradictory "X MB > X MB".
• infrastructure/nginx/Dockerfile:31 — nginx body size hard-coded 200m, not derived from MEDIA_MAX_UPLOAD_SIZE_MB. Raising the app limit silently misaligns prod.