Harden immutable release deployment

backend/tests/test_docker_runtime_config.py

@@ -167,9 +167,11 @@ def test_frontend_uses_same_origin_api_proxy_by_default() -> None:
 def test_nginx_runtime_allows_real_gis_upload_payloads() -> None:
     frontend_nginx = (ROOT / "frontend" / "nginx.conf").read_text(encoding="utf-8")
     all_in_one_nginx = (ROOT / "deploy" / "unraid" / "nginx-all-in-one.conf").read_text(encoding="utf-8")
+    start_script = (ROOT / "deploy" / "unraid" / "all-in-one-start.sh").read_text(encoding="utf-8")
 
     assert "client_max_body_size 250m;" in frontend_nginx
-    assert "client_max_body_size 250m;" in all_in_one_nginx
+    assert "client_max_body_size __GEOINTEL_MAX_UPLOAD_MB__m;" in all_in_one_nginx
+    assert 'sed -i "s/__GEOINTEL_MAX_UPLOAD_MB__/${MAX_UPLOAD_MB}/g"' in start_script
 
 
 def test_nginx_runtime_allows_long_ai_and_qa_requests() -> None:
@@ -314,11 +316,11 @@ def test_all_in_one_dockerfile_caches_dependencies_and_uses_cpu_torch_for_ai_run
 def test_unraid_deploy_passes_ai_build_arg_and_yolo_runtime_env() -> None:
     deploy_ps1 = (ROOT / "scripts" / "deploy_tower.ps1").read_text(encoding="utf-8")
     deploy_sh = (ROOT / "scripts" / "deploy_tower.sh").read_text(encoding="utf-8")
+    release_script = (ROOT / "deploy" / "unraid" / "deploy-release.sh").read_text(encoding="utf-8")
     run_script = (ROOT / "deploy" / "unraid" / "run-dockerman-container.sh").read_text(encoding="utf-8")
 
     assert 'DEPLOY_GEOINTEL_INSTALL_AI="${GEOINTEL_INSTALL_AI:-}"' in deploy_sh
-    assert 'docker build --build-arg GEOINTEL_INSTALL_AI="$GEOINTEL_INSTALL_AI"' in deploy_sh
-    assert 'docker build --build-arg GEOINTEL_INSTALL_AI="$GEOINTEL_INSTALL_AI"' in deploy_ps1
+    assert "--build-arg GEOINTEL_INSTALL_AI=" in release_script
     assert "DEPLOY_GEOINTEL_INSTALL_AI" in deploy_ps1
     assert "[string]$InstallAi" in deploy_ps1