feat: durcit l'exécution SQL IA, borne les uploads et ajoute des tests

- sql_executor: remplace le filtre regex fragile par une autorisation SQLite
  (set_authorizer) en complément de mode=ro ; rejette les instructions multiples
- uploads: lecture bornée des PDF (helper read_upload_limited, limite 20 Mo,
  HTTP 413) branchée sur /extract et /save-with-pdf
- tests: suite pytest (54 tests) couvrant amounts, dates, storage, sql_executor,
  uploads et DatabaseService.save_document ; pytest ajouté en dépendance dev

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/test_uploads.py

@@ -0,0 +1,29 @@
+"""Tests de la lecture bornée des uploads."""
+
+import asyncio
+import io
+
+import pytest
+from fastapi import UploadFile
+
+from plesna_gerance.utils.uploads import read_upload_limited, UploadTooLargeError
+
+
+def _upload(content: bytes) -> UploadFile:
+    return UploadFile(filename="x.pdf", file=io.BytesIO(content))
+
+
+def test_read_upload_under_limit():
+    content = b"hello world"
+    result = asyncio.run(read_upload_limited(_upload(content), max_size=1024))
+    assert result == content
+
+
+def test_read_upload_over_limit_raises():
+    content = b"x" * 2048
+    with pytest.raises(UploadTooLargeError):
+        asyncio.run(read_upload_limited(_upload(content), max_size=1024))
+
+
+def test_read_upload_empty():
+    assert asyncio.run(read_upload_limited(_upload(b""), max_size=1024)) == b""