fix: enhance resume state management and cleanup in chat data hook

[chenyme]

Summary

Fix media job creation failures when video generation requests include large Base64 reference images.

• Increase the media_jobs.input_json limit from 1 MiB to 32 MiB.
• Add idempotent constraint migrations for existing SQLite and PostgreSQL databases.
• Extend SQLite migration tests to cover legacy constraints, large payloads, data preservation, and repeated initialization.
• Keep existing HTTP request body and provider-specific size limits unchanged.

Change type

• Bug fix
• Feature
• Documentation
• Refactor
• Configuration / deployment
• Security hardening
• Other

Affected areas

• Frontend / UI
• Backend / API
• Authentication / authorization
• Conversations / streaming
• Files / RAG / extraction
• Model routing / providers
• MCP / tools
• Billing / payments
• Admin console
• Deployment / Docker / configuration
• Documentation

Verification

• cd backend && go test ./...

SQLite migration coverage verifies:

• Existing 1 MiB constraints are upgraded to 32 MiB.
• Payloads larger than 1 MiB can be persisted.
• Existing media jobs remain intact.
• Repeated schema initialization is idempotent.
• Foreign key enforcement is restored after table reconstruction.

Screenshots, API examples, or logs

No UI changes.

Before this fix, valid video-generation requests containing larger Base64 reference images could fail while inserting media_jobs, before reaching the upstream provider. The database error was then exposed as a generic 502 upstream_unavailable.

Configuration, migration, and compatibility notes

• Existing SQLite and PostgreSQL databases are upgraded automatically during schema initialization.
• New databases are created with the 32 MiB constraint directly.
• The migration only replaces the legacy 1048576 constraint and is safe to execute repeatedly.
• Existing media job records are preserved.
• No environment variables, public API contracts, or manual deployment steps are introduced.
• The 32 MiB limit matches the default HTTP request body limit and accommodates Base64 expansion for provider-supported 20 MiB source images.
• Other request body, media, and provider-specific limits remain unchanged.

Documentation

• Documentation is not needed for this change.
• Documentation was updated.
• Documentation still needs to be updated.

Security and privacy

• No secrets, tokens, credentials, local config, or personal data are included.
• User data access remains scoped by authenticated user context unless an admin-only path explicitly requires broader access.
• Security-sensitive behavior was reviewed, including request and provider size limits. Existing validation boundaries remain in place.

Checklist

• I searched existing issues and pull requests.
• Changes are focused and do not include unrelated refactors.
• Tests or static verification were run where practical.
• User-facing behavior, deployment steps, API contracts, or configuration changes are documented.
• Generated artifacts are included only when this project explicitly requires them.
• Caches, build output, .pyc files, .env files, and local storage data are not committed.