feat: accept sheets of up to 5 GB end to end

Sheets of several GB are the normal order. The upload limit is now 5 GB.
ClamAV scans files up to 2 GB; a larger file is released only when its
first bytes match the format its name claims, and a disguised file is
refused. The Site grades a sheet over 150 MB from the pixel size in its
PNG, JPEG or WebP header without decoding it, and reads large PDFs in
ranges. The worker never opens a source over 300 MB: a finished sheet
placed whole becomes its own print file, which the Kanban offers to approve
as the final, and anything else goes to hand preparation. Files start
uploading as they enter the cart, with progress in the summary, and each
part renews the reservation so slow uploads do not expire. Quotas grow to
50 GB per customer and 500 GB in total; the Swarm config for ClamAV is
renamed because a deployed config cannot change in place.

Verified locally with a 386 MB and a 1.8 GB PNG (scanned, paid, original
as print file), a 2.3 GB PNG (format check) and a disguised 2.3 GB file
(refused).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/checkout.js

@@ -45,8 +45,7 @@
   ready.then(session=>{
     window.dtfUploadMaxBytes=session.max_upload_bytes;
     const limit=document.getElementById('zLimite');
-    if(limit)limit.textContent='Até '+(session.max_upload_bytes/1048576).toFixed(0)+
-      ' MB por arquivo enquanto a verificação de segurança para arquivos grandes é preparada.';
+    if(limit)limit.textContent='Até '+(session.max_upload_bytes/1073741824).toFixed(0)+' GB por arquivo.';
   }).catch(()=>{});
   window.dtfSessionReady=ready;
   window.dtfApi=api;
@@ -93,9 +92,52 @@
     message('Nenhum pedido aguardando pagamento.');
     button('Ir para o carrinho', () => vaiPara(CARRINHO));
   }
+  // Files start uploading as soon as they are in the cart, so a sheet of
+  // several GB is on its way while the customer fills in the order. The
+  // checkout waits for whatever is still going.
+  const envios=new Map();
+  const chaveArquivo=f=>[f.name,f.size,f.lastModified].join('|');
+  function enviar(file) {
+    const k=chaveArquivo(file);
+    let e=envios.get(k);
+    if (!e) {
+      e={file, sent:0, done:false, failed:null};
+      e.promise=(async()=>{
+        const session=await ready;
+        return window.dtfUpload(file,{api,scope:session.cart_scope,progress:()=>{},
+          onBytes:n=>{e.sent=n;pintaEnvio();}});
+      })();
+      e.promise.then(()=>{e.done=true;pintaEnvio();},
+        error=>{e.failed=error;envios.delete(k);pintaEnvio();});
+      envios.set(k,e);
+    }
+    return e.promise;
+  }
+  const arquivosDoCarrinho=()=>[...pedido,...(busy&&itemAtual?[itemAtual]:[])].flatMap(it=>it.localFiles||[]);
+  const gb=n=>(n/1073741824).toLocaleString('pt-BR',{maximumFractionDigits:1})+' GB';
+  const mb=n=>n>=1073741824 ? gb(n) : Math.round(n/1048576)+' MB';
+  function textoEnvio() {
+    const files=arquivosDoCarrinho(); if(!files.length) return '';
+    let total=0, sent=0, pendentes=0;
+    for (const f of files) {
+      const e=envios.get(chaveArquivo(f));
+      total+=f.size; sent+=e ? Math.min(e.sent,f.size) : 0;
+      if (!e || !e.done) pendentes++;
+    }
+    if (!pendentes) return 'Arquivos enviados.';
+    if (sent>=total) return 'Arquivos enviados · verificando a segurança…';
+    return 'Enviando seus arquivos: '+Math.floor(sent/total*100)+'% ('+mb(sent)+' de '+mb(total)+')';
+  }
+  function pintaEnvio() {
+    const el=document.getElementById('envioArq');
+    const texto=textoEnvio();
+    if (el) el.textContent=texto;
+    if (busy && texto) message(texto);
+  }
+  // Only what is in the cart: the item on the product page may still change.
+  window.addEventListener('dtf-cart-changed',()=>{ arquivosDoCarrinho().forEach(f=>{ enviar(f).catch(()=>{}); }); pintaEnvio(); });
   async function upload(file) {
-    const session=await ready;
-    return window.dtfUpload(file,{api,progress:message,scope:session.cart_scope});
+    return enviar(file);
   }
   // The cart's package: billed metres and value. The charged freight is
   // quoted again by the server from the approved items.
@@ -148,6 +190,7 @@
       await ready;
       if((await api('/session')).cart_scope !== (await ready).cart_scope) throw new Error('Sua conta ou sessão mudou. Recarregue a página antes de enviar o carrinho.');
       const items=[];
+      pintaEnvio();
       for (const item of cart) {
         if (!item.localFiles?.length) throw new Error('Selecione novamente os arquivos deste item.');
         const uploads=[];