feat: durcit l'exécution SQL IA, borne les uploads et ajoute des tests

- sql_executor: remplace le filtre regex fragile par une autorisation SQLite
  (set_authorizer) en complément de mode=ro ; rejette les instructions multiples
- uploads: lecture bornée des PDF (helper read_upload_limited, limite 20 Mo,
  HTTP 413) branchée sur /extract et /save-with-pdf
- tests: suite pytest (54 tests) couvrant amounts, dates, storage, sql_executor,
  uploads et DatabaseService.save_document ; pytest ajouté en dépendance dev

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/plesna_gerance/api/routes/documents.py

@@ -13,6 +13,7 @@ from ...database import get_session, DatabaseService, storage
 from ...database.models import Document, Immeuble, Lot, Locataire, Revenu, Depense
 from ...database.service import DuplicateDocumentError
 from ...extractor import extract_compte_rendu
+from ...utils.uploads import read_upload_limited, UploadTooLargeError
 from ..schemas import SaveRequest, SaveResponse, DocumentSummary
 
 router = APIRouter(prefix="/api", tags=["documents"])
@@ -103,9 +104,11 @@ async def save_document_with_pdf(
                 status_code=400, detail=f"JSON invalide pour depenses_tags: {e}"
             )
 
-    # Read PDF content
+    # Read PDF content (taille bornée)
     try:
-        pdf_content = await pdf_file.read()
+        pdf_content = await read_upload_limited(pdf_file)
+    except UploadTooLargeError as e:
+        raise HTTPException(status_code=413, detail=str(e))
     except Exception as e:
         raise HTTPException(status_code=400, detail=f"Erreur lecture du PDF: {str(e)}")
 

src/plesna_gerance/api/routes/extraction.py

@@ -7,6 +7,7 @@ from fastapi import APIRouter, File, HTTPException, UploadFile
 from fastapi.responses import JSONResponse
 
 from ...extractor import extract_compte_rendu
+from ...utils.uploads import read_upload_limited, UploadTooLargeError
 
 router = APIRouter(prefix="/api", tags=["extraction"])
 
@@ -47,10 +48,15 @@ async def extract_pdf(
 
     tmp_path: Path | None = None
 
+    # Lecture bornée du contenu uploadé
+    try:
+        content = await read_upload_limited(file)
+    except UploadTooLargeError as e:
+        raise HTTPException(status_code=413, detail=str(e))
+
     # Sauvegarde temporaire du fichier uploadé
     try:
         with tempfile.NamedTemporaryFile(delete=False, suffix=".pdf") as tmp_file:
-            content = await file.read()
             tmp_file.write(content)
             tmp_path = Path(tmp_file.name)