feat(files): document CLI uploads

Document Bearer-authenticated multipart uploads with curl and Wget2. Return 413 for oversized multipart bodies and report attachment size limits accurately.

internal/api/files_test.go

@@ -252,7 +252,36 @@ func TestUploadRejectsOversizeBody(t *testing.T) {
 		t.Fatal(err)
 	}
 	resp.Body.Close()
-	if resp.StatusCode != http.StatusBadRequest {
-		t.Fatalf("esperava 400 para corpo acima do cap, obtive %s", resp.Status)
+	if resp.StatusCode != http.StatusRequestEntityTooLarge {
+		t.Fatalf("esperava 413 para corpo acima do cap, obtive %s", resp.Status)
+	}
+}
+
+func TestUploadRejectsFileOver64MiB(t *testing.T) {
+	var buf bytes.Buffer
+	w := multipart.NewWriter(&buf)
+	fw, err := w.CreateFormFile("file", "big.bin")
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, _ = fw.Write(bytes.Repeat([]byte("A"), store.MaxFileBytes+1))
+	if err := w.Close(); err != nil {
+		t.Fatal(err)
+	}
+
+	srv := newTestServer(t)
+	req, err := http.NewRequest("POST", srv.URL+"/api/files/upload", &buf)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req.Header.Set("Content-Type", w.FormDataContentType())
+	req.Header.Set("Authorization", "Bearer "+testToken)
+	resp, err := srv.Client().Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusRequestEntityTooLarge {
+		t.Fatalf("esperava 413 para arquivo >64 MiB, obtive %s", resp.Status)
 	}
 }