uploads: stream to disk instead of holding them in memory

Media uploads and imports now write each multipart field to uploads/ a
chunk at a time, and a zip is unpacked from disk on the blocking pool,
so the limit bounds disk rather than memory. What an archive unpacks to
is held to the same limit. The default goes from 64 MB to 1024 MB.

.env.example

@@ -18,8 +18,9 @@ WORKSPACE_BIND=127.0.0.1:4242
 # How long a login lasts, in days.
 WORKSPACE_SESSION_DAYS=30
 
-# Largest single upload, in megabytes.
-WORKSPACE_MAX_UPLOAD_MB=64
+# Largest upload, in megabytes: one request, or what an imported zip unpacks
+# to. Uploads stream to disk, so this bounds the disk, not the memory.
+WORKSPACE_MAX_UPLOAD_MB=1024
 
 # Set to 1 once the app is served over HTTPS, so the cookie gets `Secure`.
 WORKSPACE_SECURE_COOKIE=0