fix(uploads): bound concurrent request-body receives, 4 total and 2 per user (#47)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/uploads/intake_concurrency_test.go

@@ -21,8 +21,9 @@ import (
 // slowReceive starts an Accept whose body stays open until the returned writer is closed,
 // and waits until it holds a spool file, which proves it is inside the receive.
 type slowReceive struct {
-	w    *io.PipeWriter
-	done chan error
+	w        *io.PipeWriter
+	done     chan error
+	finished bool
 }
 
 func startSlowReceive(t *testing.T, r *rig, in *uploads.Intake, user string, wantFiles int) *slowReceive {
@@ -35,7 +36,18 @@ func startSlowReceive(t *testing.T, r *rig, in *uploads.Intake, user string, wan
 	}()
 	require.Eventually(t, func() bool { return len(r.tmpFiles(t)) == wantFiles }, 2*time.Second, 5*time.Millisecond,
 		"the receive for %s should have started", user)
-	t.Cleanup(func() { _ = pw.Close() })
+	// An abandoned receive ends in a read error, so it never reaches the rig's fakes, which
+	// are not safe for concurrent use. A receive that finish() already ended is a no-op.
+	t.Cleanup(func() {
+		if s.finished {
+			return
+		}
+		_ = pw.CloseWithError(errors.New("test over"))
+		select {
+		case <-s.done:
+		case <-time.After(2 * time.Second):
+		}
+	})
 	return s
 }
 
@@ -43,6 +55,7 @@ func (s *slowReceive) finish(t *testing.T) error {
 	t.Helper()
 	_, _ = s.w.Write([]byte("data"))
 	require.NoError(t, s.w.Close())
+	s.finished = true
 	select {
 	case err := <-s.done:
 		return err