feat(upload): 200mb cap + API route with XHR progress

- next.config: serverActions.bodySizeLimit + experimental.proxyClientMaxBodySize
  bumped from 500mb back down to 200mb. Batch ceiling (client side) is 180mb
  to stay comfortably under the proxy cap.
- New POST /api/jobs/[jobId]/files endpoint replaces the server action for
  upload. Same auth/permissions/rollback semantics, but Returns JSON so the
  client can read the response. Server action is retained for delete only.
- JobFilesPanel switched from useActionState to XMLHttpRequest.upload —
  xhr.upload.onprogress feeds a Progress bar (real bytes, not a fake
  ticker). Cancel button aborts the in-flight request. Successful upload
  triggers router.refresh() to repopulate the file list.

Server actions can't expose upload progress (no streaming feedback in the
RSC protocol yet), so any progress UX needs to go through fetch/XHR
against a route handler. Trade-off accepted.

next.config.ts

@@ -5,14 +5,14 @@ const nextConfig: NextConfig = {
     optimizePackageImports: ["lucide-react", "@radix-ui/react-icons"],
     serverActions: {
       // Job files bucket caps individual files at 30MB; allow batch uploads
-      // (multipart overhead + ~16 files of 30MB worst case).
-      bodySizeLimit: "500mb",
+      // up to ~6 files of 30MB worst case.
+      bodySizeLimit: "200mb",
     },
     // Next 16 renamed `middlewareClientMaxBodySize` to `proxyClientMaxBodySize`
     // (middleware.ts → proxy.ts). Default 10MB gates every body that flows
     // through our auth proxy — without this override multipart uploads exceed
     // the cap and the parser dies with "Unexpected end of form".
-    proxyClientMaxBodySize: "500mb",
+    proxyClientMaxBodySize: "200mb",
   },
   turbopack: {},