fix: harden week-two ordering, artwork and operations

app/scanning.py

@@ -1,11 +1,11 @@
 """Local ClamAV boundary. Unknown/error/over-limit results NEVER release artwork."""
-import os
 import socket
 import struct
 import time
 from fastapi import HTTPException
 from .core.auth import audit
 from .core.db import connect
+from .core.limits import scan_limit_bytes
 
 def require_clean(row):
     if not row['complete'] or row['scan_state'] != 'clean':
@@ -30,7 +30,7 @@ class ClamAV:
         return self.command(b'VERSION').decode('utf-8','replace')
 
     def scan(self, stream, size):
-        if size > min(134217728, int(os.environ.get('SCAN_MAX_BYTES','134217728'))):
+        if size > scan_limit_bytes():
             return 'rejected', 'File exceeds the malware scan limit'
         with socket.create_connection(('scanner',3310),timeout=10) as sock:
             sock.settimeout(150)