feat(upload): add file limits and ClamAV scanning

[EvanSchleret]

Summary

Extend backend file upload validation and add optional antivirus scanning through the ClamAV REST API.

Managed and staged uploads can now be scanned before storage, while direct uploads validate the actual referenced file metadata and configured limits.

Changes

• Add maxTotalSize() and max_total_size support for file fields.
• Enforce accepted types, maximum file count, per-file size, and combined file size.
• Add configurable ClamAV REST scanning for managed and staged uploads.
• Support remote HTTPS endpoints with optional Basic Authentication.
• Add configurable scanner timeout.
• Fail closed when antivirus scanning is enabled but unavailable.
• Keep antivirus scanning disabled by default.
• Add translated upload and antivirus validation messages.
• Add regression tests for file limits and ClamAV integration.

Configuration

FORMFORGE_CLAMAV_ENABLED=true
FORMFORGE_CLAMAV_ENDPOINT=https://clamav.example.com/v2/scan
FORMFORGE_CLAMAV_USERNAME=clamav-client
FORMFORGE_CLAMAV_PASSWORD=secret
FORMFORGE_CLAMAV_TIMEOUT=30