feat(desktop): make attachment data-URL size limit configurable

[Adolanium]

What does this PR do?

readFileDataUrl hard-capped local file loads at 16 MB. That path backs chat attach and image previews, so larger local files just failed with no way to raise the cap from the UI.

Settings -> Chat now has a free-form MB field for the max local attach/preview size. Main owns the persisted value under userData and applies it on every hermes:readFileDataUrl call. Default stays 16 MB. Values are clamped to 1..4096 MB as a typo guard only. The field copy notes that very large values load the whole file into memory and can freeze or crash the app.

This is a Desktop IPC / memory guard, not a model limit. The existing friendly remote-attach error still parses the real limit from the rejection string, so the toast tracks whatever is configured.

Related Issue

No open issue. Hit while attaching larger local files in Desktop.

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Security fix
• Documentation update
• Tests (adding or improving test coverage)
• Refactor (no behavior change)
• New skill (bundled or hub)

Changes Made

• apps/desktop/electron/hardening.ts: default/min/max MB helpers and clamp for the data-URL read cap.
• apps/desktop/electron/main.ts: persist data-url-read-max.json, IPC get/set, use the live cap in hermes:readFileDataUrl.
• apps/desktop/electron/preload.ts + apps/desktop/src/global.d.ts: expose dataUrlReadMax bridge.
• apps/desktop/src/store/data-url-read-max.ts: renderer mirror of the main-process value.
• apps/desktop/src/app/settings/config-settings.tsx: free-form MB input on Settings -> Chat.
• apps/desktop/src/i18n/en.ts + types.ts: labels and description.
• apps/desktop/src/store/data-url-read-max.test.ts + apps/desktop/electron/hardening.test.ts: clamp/store coverage.

How to Test

1. npx vitest run src/store/data-url-read-max.test.ts electron/hardening.test.ts
   • 2 files, 16 tests passed
2. Manual: open Desktop -> Settings -> Chat. Confirm "Max attachment size" shows 16 MB. Set 32, restart the app, confirm it sticks.
3. Attach a file larger than the old 16 MB default after raising the cap. It should load instead of failing with the too-large toast.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run the vitest suites above and they pass. Full desktop e2e not run here. Change is isolated to the data-URL attach cap + Settings UI + tests.
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: Windows 11

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) - or N/A (code comments on the IPC path only)
• I've updated cli-config.yaml.example if I added/changed config keys - or N/A (device-local Desktop pref, not config.yaml)
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows - or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide - Electron main + Settings UI only. Built and exercised on Windows 11.
• I've updated tool descriptions/schemas if I changed tool behavior - or N/A

Screenshots / Logs

npx vitest run src/store/data-url-read-max.test.ts electron/hardening.test.ts

 Test Files  2 passed (2)
      Tests  16 passed (16)

Settings -> Chat shows a free-form MB input (default 16). Raising it and reopening the app keeps the saved value under userData.

[austinpickett]

Approving. Verified against head 156eb54 on Windows.

What it does: Makes the desktop data-URL read cap (composer attach + local previews) configurable via a free-form MB field in Settings > Chat, replacing the hard 16 MB DATA_URL_READ_MAX_BYTES. Main process owns the persisted value under userData and applies it on every hermes:readFileDataUrl call. Default stays 16 MB.

Verification (PR head):

• Tests: 17/17 in the two PR files (hardening 13, store 4), plus 93/93 in the touched use-prompt-actions/index.test.tsx. The clamp and store tests are non-vacuous: bounds (undefined to 16, 0 to the 1 floor, 99999 to the 4096 ceiling), rounding, write-through, and failure-keeps-last-known-good.
• Typecheck: 26 tsc errors on the branch, but the identical 26 reproduce on clean main (all missing-transitive-dep noise in an incomplete node_modules). Zero reference any file this PR touches.
• Lint: clean on all touched files.

Design notes:

• Device-local pref (not config.yaml) is the right call for a per-machine memory guard, and is consistent with the keep-awake precedent. Correctly skips cli-config.yaml.example.
• i18n is safe: en and zh are strict Translations and both were updated, types.ts too. ja/zh-hant/ar go through defineLocale (partial merge over en), so they fall back to English rather than failing the build on the new keys.
• The clamp constants are duplicated between electron/hardening.ts and src/store/data-url-read-max.ts, but that split is forced by the process boundary (the renderer cannot import electron main). Both carry keep-in-sync comments. It is the only ongoing maintenance cost here, not a blocker.