fix: adjust upload limits to 20MB profile, 30MB portfolio

backend/handlers/portfolio/images.go

@@ -706,6 +706,7 @@ func UploadImage(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// #nosec G120 — body size limited by limitBody middleware
 	if err := r.ParseMultipartForm(10 << 20); err != nil {
 		var maxBytesErr *http.MaxBytesError
 		if errors.As(err, &maxBytesErr) {

backend/handlers/portfolio/images_test.go

@@ -34,17 +34,6 @@ import (
 )
 
 func makeRequest(handler http.HandlerFunc, method, path string, body interface{}, ctx context.Context) *httptest.ResponseRecorder {
-	var req *http.Request
-	if body != nil {
-		bodyBytes, _ := json.Marshal(body)
-		req = httptest.NewRequest(method, path, bytes.NewReader(bodyBytes))
-		req = req.WithContext(ctx)
-		req.Header.Set("Content-Type", "application/json")
-	} else {
-		req = httptest.NewRequest(method, path, nil)
-		req = req.WithContext(ctx)
-	}
-
 	return makeRequestWithContext(handler, method, path, body, "", "", ctx)
 }
 

backend/handlers/user/profile.go

@@ -1002,6 +1002,7 @@ func UploadProfilePictureHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// #nosec G120 — body size limited by limitBody middleware
 	if err := r.ParseMultipartForm(1 << 20); err != nil {
 		var maxBytesErr *http.MaxBytesError
 		if errors.As(err, &maxBytesErr) {

backend/main.go

@@ -69,8 +69,8 @@ func limitBody(limit int64) func(http.Handler) http.Handler {
 
 const (
 	defaultBodyLimit   int64 = 1 * 1024 * 1024  // 1MB
-	uploadBodyLimit    int64 = 15 * 1024 * 1024 // 15MB
-	portfolioBodyLimit int64 = 40 * 1024 * 1024 // 40MB (7 variants from 20MB source)
+	uploadBodyLimit    int64 = 20 * 1024 * 1024 // 20MB
+	portfolioBodyLimit int64 = 30 * 1024 * 1024 // 30MB (7 variants)
 )
 
 // nColor / bColor — Chi-style ANSI colors for request logging.