fix(api): correct fileData max-length to 100MB and allow localhost in URL validation

Raise base64 @maxlength to 134_217_728 (~100MB binary) to match the
service's file-size policy. Set require_tld: false on @isurl so
http://localhost redirect URLs used in local/dev flows are not rejected.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: carhartlewis

apps/api/src/attachments/upload-attachment.dto.ts

@@ -35,7 +35,7 @@ export class UploadAttachmentDto {
   })
   @IsString()
   @IsNotEmpty()
-  @MaxLength(67_108_864)
+  @MaxLength(134_217_728)
   @IsBase64()
   fileData: string;
 

apps/api/src/background-checks/dto/background-check-billing.dto.ts

@@ -2,11 +2,11 @@ import { IsString, IsUrl } from 'class-validator';
 
 export class BackgroundCheckSetupSessionDto {
   @IsString()
-  @IsUrl({}, { message: 'successUrl must be a valid URL' })
+  @IsUrl({ require_tld: false }, { message: 'successUrl must be a valid URL' })
   successUrl: string;
 
   @IsString()
-  @IsUrl({}, { message: 'cancelUrl must be a valid URL' })
+  @IsUrl({ require_tld: false }, { message: 'cancelUrl must be a valid URL' })
   cancelUrl: string;
 }
 
@@ -17,6 +17,6 @@ export class BackgroundCheckSetupSuccessDto {
 
 export class BackgroundCheckBillingPortalDto {
   @IsString()
-  @IsUrl({}, { message: 'returnUrl must be a valid URL' })
+  @IsUrl({ require_tld: false }, { message: 'returnUrl must be a valid URL' })
   returnUrl: string;
 }