Add security fixes: SHA256 hash validation and streaming file size enforcement

- Add field_validator to ResumableUploadInitRequest to validate expected_hash
  is a valid 64-character lowercase hex SHA256 hash (normalizes to lowercase)
- Add FileSizeExceededError exception for file size limit violations
- Enforce file size limits in storage layer during streaming (prevents
  Content-Length header spoofing)
- Add FileSizeExceededError handler in upload endpoint returning HTTP 413
- Add node_modules and frontend/dist to .gitignore

backend/app/routes.py

@@ -28,6 +28,7 @@ from .storage import (
     MULTIPART_CHUNK_SIZE,
     StorageError,
     HashComputationError,
+    FileSizeExceededError,
     S3ExistenceCheckError,
     S3UploadError,
     S3StorageUnavailableError,
@@ -1033,6 +1034,12 @@ def upload_artifact(
             status_code=500,
             detail="Data integrity error detected. Please contact support.",
         )
+    except FileSizeExceededError as e:
+        logger.warning(f"File size exceeded during upload: {e}")
+        raise HTTPException(
+            status_code=413,
+            detail=f"File too large. Maximum size is {settings.max_file_size // (1024 * 1024 * 1024)}GB",
+        )
     except StorageError as e:
         logger.error(f"Storage error during upload: {e}")
         raise HTTPException(status_code=500, detail="Internal storage error")