Fix the security audit's findings

Fixes the nine findings of security audit run 1 on 2.4.1 (T1-T11).

F1: Uploads that are not complete now count only the bytes the server
received, and a chunk that goes above the storage quota gets 422. An
anonymous uploader can no longer fill the quota with declared sizes.

F2: The share password and the admin login have a second limit without
the address (20 attempts per minute per share and per e-mail), because
a forged X-Forwarded-For changes the address.

F3: The system password gate and the admin check now also run on
Livewire updates, so an old uploader snapshot cannot register files.

F4: The session keeps a fingerprint of the system password's hash.
When the admin changes the system password, earlier verifications end.

F5: The page after the upload opens only in the session that created
the share, and only while recipients can still reach the share.

F6: The share password limit counts an attempt before the password is
checked, so parallel attempts cannot pass it.

F7: The system password has the same two limits (5 per address, 20 in
total per minute).

F8: A password change or reset signs the user's other sessions out.

F9: The only admin cannot delete the account, which would open /setup
to every visitor.

The setup wizard also holds the admin password to the password
defaults, and Livewire applies EnsureAdmin to updates.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/Unit/ShareServiceTest.php

@@ -230,14 +230,36 @@ test('a file that takes the share beyond the admin size per share is rejected',
         ->toThrow(ValidationException::class, 'Total file size exceeds the maximum allowed per share.');
 });
 
-test('a file that does not fit the storage quota beside files still uploading is rejected', function () {
+test('a file that does not fit the storage quota beside the bytes already received is rejected', function () {
+    config(['uploads.chunk_size' => 10]);
     Setting::set('max_storage_quota', 100);
-    Share::factory()->pending()->create(['total_size' => 60]);
+    $pending = Share::factory()->pending()->create(['total_size' => 60]);
+    ShareFile::factory()->for($pending)->uploading()->create(['file_size' => 60, 'uploaded_chunks' => 1]);
 
-    expect(fn () => $this->service->registerFile(null, 'file.txt', 50, null))
+    expect(fn () => $this->service->registerFile(null, 'file.txt', 95, null))
         ->toThrow(ValidationException::class, 'Storage is full. Please contact the administrator.');
 });
 
+test('a file still uploading without received chunks does not use up the storage quota', function () {
+    config(['uploads.chunk_size' => 10]);
+    Setting::set('max_storage_quota', 100);
+    $pending = Share::factory()->pending()->create(['total_size' => 60]);
+    ShareFile::factory()->for($pending)->uploading()->create(['file_size' => 60, 'uploaded_chunks' => 0]);
+
+    expect($this->service->registerFile(null, 'file.txt', 50, null))->toBeInstanceOf(ShareFile::class);
+});
+
+test('a chunk that takes the stored bytes beyond the storage quota is rejected', function () {
+    config(['uploads.chunk_size' => 4]);
+    Setting::set('max_storage_quota', 100);
+    $file = $this->service->registerFile(null, 'notes.txt', 6, null);
+    Share::factory()->create(['total_size' => 98]);
+
+    expect(fn () => $this->service->storeChunk($file, 0, encryptedChunk($file, 'abcd', 0, false)))
+        ->toThrow(InvalidArgumentException::class, 'Chunk 0 exceeds the storage quota');
+    expect($file->refresh()->uploaded_chunks)->toBe(0);
+});
+
 test('chunks stored in order complete the file', function () {
     config(['uploads.chunk_size' => 4]);
     $file = $this->service->registerFile(null, 'notes.txt', 6, null);