fix(app): harden account and workflow state

tools/summarizer/tests/test_app.py

@@ -510,6 +510,18 @@ def test_health_stays_open_so_probes_and_healthchecks_work(monkeypatch):
     assert client.get("/health").status_code == 200
 
 
+def test_extract_text_rejects_oversized_upload_before_parsing(monkeypatch):
+    module = load_app_module(monkeypatch)
+    monkeypatch.setattr(module, "MAX_EXTRACT_FILE_BYTES", 32)
+    monkeypatch.setattr(module, "_extract_plain_text", lambda data: (_ for _ in ()).throw(AssertionError("parser must not run")))
+    client = TestClient(module.app)
+
+    response = client.post("/extract-text", files={"file": ("large.txt", b"x" * 64, "text/plain")})
+
+    assert response.status_code == 400
+    assert "too large" in response.json()["detail"].lower()
+
+
 def test_cache_purge_requires_service_token_and_clears_content(monkeypatch):
     module = load_app_module(monkeypatch, service_token="s3cret")
     module.cache["synthetic-key"] = "synthetic-summary"