test: define open alpha acceptance gates

apps/api/tests/test_api.py

@@ -62,6 +62,7 @@ def test_list_pagination_and_filter_validation() -> None:
     headers = {"Authorization": "Bearer change-me-in-production"}
     assert client.get("/api/v1/admin/external-observations?status=unknown", headers=headers).status_code == 422
     assert client.get("/api/v1/admin/catch-reports?offset=-1", headers=headers).status_code == 422
+    assert client.get("/api/v1/admin/catch-reports?limit=101", headers=headers).status_code == 422
 
 
 def test_liveness_does_not_probe_dependencies() -> None:

apps/api/tests/test_storage.py

@@ -6,6 +6,7 @@ import pytest
 from PIL import Image
 
 from app.storage import ScreenshotError, prepare_image, validate_upload_metadata
+from app.config import settings
 
 
 def test_prepare_image_removes_metadata() -> None:
@@ -28,6 +29,11 @@ def test_prepare_image_rejects_non_image() -> None:
         prepare_image(b"not an image")
 
 
+def test_prepare_image_rejects_oversized_body_before_decoding() -> None:
+    with pytest.raises(ScreenshotError, match="8 MB"):
+        prepare_image(b"x" * (settings.screenshot_max_bytes + 1))
+
+
 def test_upload_metadata_requires_matching_supported_mime_and_extension() -> None:
     validate_upload_metadata("catch.jpeg", "image/jpeg")
     validate_upload_metadata("catch.webp", "image/webp")