fix: configurable internal API URL and upload size enforcement

H4: add internal_api_base_url setting to config.py (default http://localhost:8888,
    env-overridable via INTERNAL_API_BASE_URL); replace all 5 hardcoded base_url
    strings in chat_service.py.

H6: add post-read size check in both Excel and STEP upload handlers;
    raises HTTP 413 when content exceeds settings.max_upload_size_mb.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/config.py

@@ -94,6 +94,9 @@ class Settings(BaseSettings):
     azure_openai_deployment: str = "gpt-4o"
     azure_openai_api_version: str = "2024-02-01"
 
+    # Internal API (used by chat_service for self-calls — override in Docker if port changes)
+    internal_api_base_url: str = "http://localhost:8888"
+
     # File Storage
     upload_dir: str = "/app/uploads"
     max_upload_size_mb: int = 500