feat(OXICLOUD_DIRECT_PUT_MAX_BYTES): add a security limit on direct PUT

ensure files does not exeed OXICLOUD_MAX_UPLOAD_SIZE, prefer to deny from header rather consuming bandwidth
    add OXICLOUD_DIRECT_PUT_MAX_BYTES for direct PUT (non chunked), admins can fine tune their prefered values

src/interfaces/api/handlers/webdav_handler.rs

@@ -927,8 +927,10 @@ async fn handle_put(
     //  another user — acceptable risk since PathResolver should always
     //  be enabled in production)
 
-    // Hard upload size limit from config
-    let max_upload = state.core.config.storage.max_upload_size;
+    // Direct PUT cap — see `nextcloud/webdav_handler::handle_put` for
+    // the reasoning. Files above `direct_put_max_bytes` must go through
+    // the chunked-upload protocol (`/api/uploads/…`) which is resumable.
+    let max_upload = state.core.config.storage.direct_put_max_bytes;
 
     // Extract content type before consuming the request
     let content_type = req