bug: bound XML import memory usage by limiting payload size and read strategy

[somethingwithproof]

Summary

Alert/report/removal import reads full uploaded file into memory with no explicit size guard.

Evidence

• syslog_alerts.php:947-948
• syslog_reports.php:809-810
• syslog_removal.php:747-748

Pattern: fopen + fread(... filesize(...)) + xml2array($xml_data).

Impact

Large uploads can exhaust PHP memory and destabilize admin requests.

Expected fix

• Enforce explicit maximum import size
• Fail fast with user-visible validation message
• Prefer safer read/parse strategy that avoids unnecessary full-buffer pressure

[somethingwithproof]

Confirmed unresolved on develop. PR #326 provides the focused remediation: a 5 MiB cap for text and file imports, size validation before reading, and shared handling across alert/report/removal imports. Its current CI is green. Keep this issue open until #326 lands and the size/error behavior is exercised in integration.