feat: env-driven upload limits + request timeout, inline video playback, range requests

- Add UPLOAD_FILE_LIMIT_MB/UPLOAD_TOTAL_LIMIT_MB env (defaults 50/200), compute request timeout from total limit or UPLOAD_REQUEST_TIMEOUT_MS
- Expose upload limits via /api/public-settings and sync in frontend (remove hardcoded 50MB assumption)
- Add byte-range support in storage (getRange/streamRangeTo) and serve Content-Range/Accept-Ranges for S3/local
- Implement inline playable video delivery for browser formats (mp4/m4v/webm/ogv) with ?play=1, range requests, proper 206/416
- Add video modal in journal UI with player and download fallback
- Update docs (AGENTS.md/PRD.md/README.md), styles for video modal, add instructions/TODO.md and screenshots
- Extend MIME types for media

PRD.md

@@ -47,6 +47,7 @@
 | ENT-6 | Pagination (limit/offset) + total count | Must |
 | ENT-7 | Anti-spam: min interval between entries per student (configurable, default 30 min) | Must |
 | ENT-8 | Files attached to entry: upload (max 10 files, per-file and total size limits from `UPLOAD_FILE_LIMIT_MB`/`UPLOAD_TOTAL_LIMIT_MB`), download by token | Must |
+| ENT-9 | Video attachments: `mp4`/`m4v`/`webm`/`ogv` playable inline in the journal with seeking (Range), other video formats download-only | Should |
 
 ### 2.4 Files Management (Centralized)
 | ID | Requirement | Priority |
@@ -175,7 +176,7 @@ branches
 | GET | `/api/files` | Admin | All files (filters) |
 | GET | `/api/files/detached` | Admin | Detached files |
 | POST | `/api/files/:id/detach` | Admin | Detach file |
-| GET | `/api/files/:token` | Public | Download file by token |
+| GET | `/api/files/:token` | Public | Download file by token; `?play=1` serves `mp4`/`m4v`/`webm`/`ogv` inline with `Range` support |
 | GET | `/api/groups` | Public | List groups |
 | POST/PUT/DELETE | `/api/groups` | Admin | CRUD groups |
 | GET/POST | `/api/groups/:id/photos` | Admin | Group photo chronicle |