sheet upload fix

app/infrastructure/security.py

@@ -72,8 +72,8 @@ ROLE_PERMISSIONS: Dict[str, List[str]] = {
         "view_nutrition_insights",
         "optimize_profits",
     ],
-    # A third party who may drop spreadsheets into the review inbox and do
-    # NOTHING else. One permission, deliberately.
+    # An outside API client that may send spreadsheets for catalog ingestion and
+    # do NOTHING else. One permission, deliberately.
     #
     # This role exists because API keys carry no per-key scoping:
     # principal_for_api_key() derives permissions entirely from the role, so
@@ -82,9 +82,17 @@ ROLE_PERMISSIONS: Dict[str, List[str]] = {
     # add_product, upload_batch_products and upload_store_inventory - real
     # write access to the catalog - to solve a problem that needed one verb.
     #
-    # Nothing this role can do starts work: an uploaded file waits in the inbox
-    # until an admin selects it. So the worst an leaked uploader key costs is
-    # bounded disk (INBOX_MAX_PENDING_FILES), never CPU on a one-vCPU host.
+    # WHAT A LEAKED UPLOADER KEY COSTS. Real CPU: this permission starts the
+    # 11-stage pipeline, which is the point of the endpoint. The bound is not
+    # "this role cannot work" but "all ingestion, from every source, shares one
+    # worker" - batch_worker runs a single batch at a time behind a queue of
+    # BATCH_QUEUE_MAX, past which POST /api/uploads/catalog answers 429. So a
+    # key can occupy the ingestion worker; it cannot multiply it, and it cannot
+    # touch the request path the healthcheck reads.
+    #
+    # What it still cannot do: read the catalog, read another caller's
+    # submissions (every read on that router is filtered by submitted_by), or
+    # cancel, resume or delete anything.
     "uploader": [
         "upload_catalog",
     ],