Fix the security audit's findings

Fixes the nine findings of security audit run 1 on 2.4.1 (T1-T11).

F1: Uploads that are not complete now count only the bytes the server
received, and a chunk that goes above the storage quota gets 422. An
anonymous uploader can no longer fill the quota with declared sizes.

F2: The share password and the admin login have a second limit without
the address (20 attempts per minute per share and per e-mail), because
a forged X-Forwarded-For changes the address.

F3: The system password gate and the admin check now also run on
Livewire updates, so an old uploader snapshot cannot register files.

F4: The session keeps a fingerprint of the system password's hash.
When the admin changes the system password, earlier verifications end.

F5: The page after the upload opens only in the session that created
the share, and only while recipients can still reach the share.

F6: The share password limit counts an attempt before the password is
checked, so parallel attempts cannot pass it.

F7: The system password has the same two limits (5 per address, 20 in
total per minute).

F8: A password change or reset signs the user's other sessions out.

F9: The only admin cannot delete the account, which would open /setup
to every visitor.

The setup wizard also holds the admin password to the password
defaults, and Livewire applies EnsureAdmin to updates.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/Services/ShareService.php

@@ -10,6 +10,7 @@ use Illuminate\Contracts\Session\Session;
 use Illuminate\Database\Eloquent\ModelNotFoundException;
 use Illuminate\Http\UploadedFile;
 use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\Storage;
 use Illuminate\Support\Str;
@@ -104,7 +105,7 @@ class ShareService
      * Verify the encrypted chunk that comes next for a file and write it into place; returns how
      * many of the file's chunks are stored. The plaintext only exists in memory, to be checked.
      *
-     * @throws InvalidArgumentException when the chunk has the wrong length or fails authentication
+     * @throws InvalidArgumentException when the chunk has the wrong length, exceeds the storage quota or fails authentication
      * @throws ModelNotFoundException when the file was removed meanwhile
      */
     public function storeChunk(ShareFile $file, int $index, string $chunk): int
@@ -134,6 +135,10 @@ class ShareService
                 throw new InvalidArgumentException('Chunk '.$index.' has the wrong length');
             }
 
+            if ($this->getTotalUsedSpace() + $plaintextLength > $this->getMaxStorageQuota()) {
+                throw new InvalidArgumentException('Chunk '.$index.' exceeds the storage quota');
+            }
+
             try {
                 $plaintext = $this->encryptionService->decryptChunk($chunk, $share->encryption_key, $noncePrefix, $index, $isLast);
             } catch (RuntimeException) {
@@ -448,11 +453,17 @@ class ShareService
     }
 
     /**
-     * Get total used space in bytes, files still being uploaded included.
+     * Get total used space in bytes; files still being uploaded count with the bytes received so far.
      */
     public function getTotalUsedSpace(): int
     {
-        return (int) Share::query()->sum('total_size');
+        $chunkSize = (int) config('uploads.chunk_size');
+
+        $received = ShareFile::query()
+            ->whereHas('share', fn ($query) => $query->whereNull('completed_at'))
+            ->sum(DB::raw("CASE WHEN uploaded_chunks * {$chunkSize} < file_size THEN uploaded_chunks * {$chunkSize} ELSE file_size END"));
+
+        return (int) Share::query()->whereNotNull('completed_at')->sum('total_size') + (int) $received;
     }
 
     /**