Expose knowledge-base upload size ceiling as admin-configurable #72

Context

docs/CONFIG_AUDIT_2026-09-04.md found that backend/app/core/config.py:221 hardcodes knowledge_base_upload_max_bytes = 25 * 1024 * 1024 (25 MiB) as an env-only field — not DB-backed, unlike comparable ceilings such as guardrail_max_input_length (env-default + nullable DB override, capped by a hard non-overridable ceiling per Phase 4c's pattern).

Scope

1. Add nullable SystemSettings column knowledge_base_upload_max_bytes, following the exact max_input_length pattern: a hard, non-overridable ceiling constant in code (e.g. KNOWLEDGE_BASE_UPLOAD_MAX_BYTES_CEILING) enforced at the API request boundary, with the DB value bounded by it.
2. Wire into the upload endpoint's existing size check (backend/app/api/knowledge_base.py or wherever the current env-only field is read).
3. Add to the existing Settings UI (new field in whichever section fits best — likely alongside other content-handling settings) with a tooltip.
4. Audit-log on change.

Non-goals

• knowledge_base_upload_allowed_content_types (the MIME type allow-list) is explicitly excluded from this issue — the audit judged a free-text DB-editable list unsafe, since each type maps to specific extraction code in text_extraction.py that must exist to support it. If ever exposed, it should be per-type on/off toggles over the existing fixed set (like guardrail pattern toggles), which is a larger, separate design — not bundled here.

Definition of Done

• knowledge_base_upload_max_bytes nullable column + non-overridable ceiling constant + Alembic migration.
• Resolver wired into the upload size check, unit-tested at and beyond the ceiling.
• Settings UI field + tooltip.
• Audit logging on change.
• RBAC call-out per AGENTS.md TDD Discipline step 0: admin feature.
• Standard merge gate from AGENTS.md's Definition of Done applies in full.