fix: configurable source upload size, clearer gradient build errors, per-package failure scoping

[DerDennisOP]

Closes #489, #491, #492, #493.

• max upload size is not configurable #492 Source upload size is now configurable (GRADIENT_MAX_SOURCE_UPLOAD_SIZE / settings.maxSourceUploadSize, default 512 MiB) for POST /build-requests/source and the chunked manifest total; the built-in nginx/caddy client_max_body_size is derived from the largest configured upload limit instead of a hardcoded 100M.
• gradient build is not very talkative about errors #491 gradient build upload failures now report the attempted size and file count with status-specific guidance for 413/400, and no longer dump the raw reverse-proxy HTML.
• Gradient build should show a better error message when the logged in token is not valid #493 gradient build pre-flights a cheap authenticated probe and reports auth failures as "run gradient login" instead of a confusing 413/400.
• No clear way to figure out which build caused a package to fail to build #489 GET /evals/{evaluation}/builds takes an optional scope=<build_job> that restricts results to that package's dependency closure; clicking a failed package now shows only the failures that caused it, with a "Show all" toggle.

[DerDennisOP]

Follow-up (addresses the 502 sendfile() Broken pipe): rather than only raising the limit, gradient build now uploads the source NAR in bounded 32 MiB chunks via PUT /build-requests/source/{upload}/chunk + finalize (keyed by the NAR's blake3 hash, so a retry resumes from the server's staged offset). No single request carries the whole source, so it can't trip a body limit or drop the connection mid-stream. max_source_upload_size stays as the staged-total guard; the single-shot endpoint is kept for back-compat.

Also folds in a one-line fix for an unrelated pre-existing test (directory_tarball_preserves_symlinks): its NAR directory entries were unsorted, which the stricter harmonia parser (bumped on main) now rejects.