server: drag-drop config path — fail-fast single-issue validation, unbounded drop payload, .yaml/.yml whitelist asymmetry #138

Problem

End-to-end walk of the drag-drop-config path (web/src/utils/configDrop.ts → POST /api/config/load-content → ConfigReader.from_content):

1. Validation gap. The drop endpoint validates via ConfigReader.from_content, which is deliberately fail-fast ("raises on the first problem", per its own docstring and the header of core/config/diagnostics.py) — a dropped draft with 4 problems reports only the first, while the editor's /validate path returns all issues via collect_config_issues (already wired into validate_issues at routes/config.py:187-203). Same data, two reporting modes; style(editor): dark-theme syntax palette + multi-issue validation report #111 made the editor multi-issue but the drop path did not follow.
2. Size/encoding guard. handleDroppedConfig reads await file.text() with no size limit and POSTs it as one JSON body; the server accepts any body size. Dropping a multi-hundred-MB .yaml freezes the tab and spikes server memory.
3. Whitelist asymmetry. Drops accept .yaml/.yml (_ACCEPTED_DROP_SUFFIXES, routes/config.py:237-243), but SAVE_AS_EXTENSIONS (config.py:481) only allows .profiles/.profiles.yaml — a user who drops my.yaml, edits it, then presses Save As is forced to rename; and POST /config/load (disk path) rejects .yaml/.yml too (_is_config_path, config.py:64-73), so a .yml trial cannot be re-opened from disk.
4. Minor: pickConfigFile (configDrop.ts:23-30) silently drops all but the first accepted file in a multi-file drop.

Suggested fix

1. In load_content_endpoint, build the 400 detail from collect_config_issues(payload.content) instead of the first ValueError.
2. Add a client-side size check (e.g. 2 MB) in handleDroppedConfig and a server body limit.
3. Align the three whitelists (drop / load / save-as) on one shared tuple.
4. Surface "N of M files ignored" or pick by extension priority in pickConfigFile.