fix(handlers): bypass box creation limits for batched uploads

Update `createOrAppendBox` to accept the upload policy and admin status, allowing policy enforcement to be handled during the box creation/append decision process. This ensures that appending files to an existing batch does not incorrectly trigger daily or active box creation limits, as no new box is being created.

Also, add unit tests to verify that batched uploads successfully bypass both daily and active box creation caps.

backend/libs/handlers/upload_group.go

@@ -48,7 +48,7 @@ func (g *uploadGrouper) entryFor(key string) *uploadGroupEntry {
 	g.pruneLocked(time.Now())
 	entry, ok := g.entries[key]
 	if !ok {
-		entry = &uploadGroupEntry{}
+		entry = &uploadGroupEntry{at: time.Now()}
 		g.entries[key] = entry
 	}
 	return entry
@@ -56,8 +56,8 @@ func (g *uploadGrouper) entryFor(key string) *uploadGroupEntry {
 
 // pruneLocked drops entries whose last use is well past the grouping window so
 // the map stays bounded to recently-active keys. Callers must hold g.mu. Entries
-// currently in use, or freshly created but not yet used (zero timestamp), are
-// kept to avoid removing one a request is about to populate.
+// currently in use are kept to avoid removing one a request is about to
+// populate.
 func (g *uploadGrouper) pruneLocked(now time.Time) {
 	if now.Sub(g.lastPrune) < uploadGroupPruneInterval {
 		return
@@ -67,7 +67,7 @@ func (g *uploadGrouper) pruneLocked(now time.Time) {
 		if !entry.mu.TryLock() {
 			continue
 		}
-		stale := !entry.at.IsZero() && now.Sub(entry.at) > 2*uploadGroupWindow
+		stale := now.Sub(entry.at) > 2*uploadGroupWindow
 		entry.mu.Unlock()
 		if stale {
 			delete(g.entries, key)