Align upload limits with new MEDIA_MAX_UPLOAD_SIZE_MB app cap

[turegjorup]

Summary

Upstream PR os2display/display-api-service#458
(merged into upstream release/3.0.0 on 2026-05-26, issue
#392) introduced a new
Symfony-level upload ceiling: MEDIA_MAX_UPLOAD_SIZE_MB
(default 200 MiB), enforced by MediaFileValidator on Media::$file.

The cap flows into .env.symfony automatically via task env:init (which extracts the
upstream /app/.env), but the PHP and nginx example defaults shipped here (128M /
140M / 140m) were below it — large uploads would have been rejected at the proxy /
PHP layer with an opaque 413 instead of the app's clear validator error message.

• Bump .env.php.example: PHP_UPLOAD_MAX_FILESIZE 128M → 200M, PHP_POST_MAX_SIZE 140M → 210M.
• Bump .env.nginx.example: NGINX_MAX_BODY_SIZE 140m → 210m.
• Comments in both files now reference the upstream MEDIA_MAX_UPLOAD_SIZE_MB ceiling.
• New UPGRADE.md sub-section under §5 "Rewrite env config" spells out the four-layer
  inequality (NGINX_MAX_BODY_SIZE >= PHP_POST_MAX_SIZE >= PHP_UPLOAD_MAX_FILESIZE >= MEDIA_MAX_UPLOAD_SIZE_MB)
  and gives operators an env:diff step to catch a migrated .env.symfony that predates the new var.
• CHANGELOG entry under Operations.

Test plan

• Fresh install: task env:init on this branch writes PHP_UPLOAD_MAX_FILESIZE=200M, PHP_POST_MAX_SIZE=210M, NGINX_MAX_BODY_SIZE=210m into the per-service env files.
• Stack comes up: task install succeeds, all services healthy.
• App-level cap is the binding constraint: upload a ~150 MiB file in the admin UI → succeeds (well below app's 200 MiB cap, but above the old 128M PHP limit, proving the old limit would have rejected it).
• App-level cap rejects clearly: upload a >200 MiB file → Symfony validator error referencing MEDIA_MAX_UPLOAD_SIZE_MB, not a generic 413.
• task env:diff against the upstream image produces no spurious diff on the upload-related keys.
• UPGRADE.md §5 renders correctly — the new sub-section lands before §6 "MariaDB 10.x → 11.4 upgrade".

🤖 Generated with Claude Code