Harden: cap request body before reading, WAL for concurrent writes, socket timeout, surface unmeasured edges

- _body() read the full declared Content-Length into memory before any size
  check, so MAX_UPLOAD_BYTES could only reject an upload already held in
  RAM. nginx caps this on the proxied path, but the container also listens
  on the LAN, so the app now enforces its own 20MB ceiling and closes the
  connection rather than reading.
- SQLite ran with the default rollback journal and 5s lock timeout, chosen
  when a row was a few KB; rows now carry the original photos, so two
  people grading at once could block each other's History. WAL + 30s.
- No socket timeout meant a stalled keep-alive connection held a worker
  thread indefinitely.
- An edge excluded as a different material was dropped from the UI with no
  explanation, presenting three sides as though they were all four.

store.py

@@ -60,9 +60,20 @@ DEFAULT_SETTINGS = {
 
 
 def connect():
-    conn = sqlite3.connect(DB_PATH)
+    # timeout: how long to wait for a writer's lock before giving up. The
+    # server is threaded, so two people grading at once genuinely collide —
+    # and since a row now carries the original photos, a write can be
+    # several megabytes and hold the lock long enough to matter. The 5s
+    # default was chosen for small writes; this isn't that any more.
+    conn = sqlite3.connect(DB_PATH, timeout=30.0)
     conn.row_factory = sqlite3.Row
     conn.execute("PRAGMA foreign_keys = ON")
+    # WAL lets readers carry on during a write instead of blocking on it,
+    # which is the difference between "someone else is grading" being
+    # invisible and it freezing everyone's History. Persists on the database
+    # file itself, so setting it per-connection is just belt-and-braces.
+    conn.execute("PRAGMA journal_mode = WAL")
+    conn.execute("PRAGMA synchronous = NORMAL")
     return conn