File uploads look like a checkbox on the product roadmap until a 2 GB video stalls checkout, a hotlinked avatar burns your CDN bill, or someone discovers y…