prometheus: raise ClamAV size limits to match the 2 GiB upload cap

ClamAV ships with StreamMaxLength=25 MB, MaxFileSize=100 MB, MaxScanSize=
400 MB — mobile APKs over 25 MB came back as "INSTREAM size limit
exceeded" from the scanner, which the service wrapped in a 502 JSON
body, which Caddy sometimes replaced with its own HTML error page under
flaky mobile transport. The browser then saw 'Unexpected token <' and
told the user 'Network error'.

Overlay a minimal clamd.conf (mirrors the image default plus the three
raised limits, all pinned at 2 GiB = 2147483648 bytes) via a read-only
bind mount. Rebuild not needed — only clamav restarts.

deploy/clamd.conf

@@ -0,0 +1,26 @@
+# clamd.conf for Prometheus
+#
+# Overlays the ClamAV official image's default clamd.conf. The one change
+# that matters is the three size limits: Prometheus accepts files up to
+# 2 GiB (Caddy + MAX_FILE_BYTES both pinned there), and ClamAV's defaults
+# are much lower (StreamMaxLength 25 MB, MaxFileSize 100 MB, MaxScanSize
+# 400 MB). Without these overrides, a mobile APK over ~25 MB comes back
+# as `"INSTREAM size limit exceeded. ERROR"` and the service rejects it.
+#
+# The LogFile / LocalSocket / TCPSocket / User lines mirror the image's
+# default so dropping this file in via a bind mount doesn't lose anything.
+
+LogFile /var/log/clamav/clamd.log
+LogTime yes
+LocalSocket /tmp/clamd.sock
+TCPSocket 3310
+User clamav
+
+# --- size limits, raised to match Prometheus's 2 GiB upload cap ----------
+# INSTREAM is the TCP streaming scan path the service uses — the one that
+# returns "INSTREAM size limit exceeded" when the client sends too many
+# bytes. StreamMaxLength caps the stream; the other two cap the file and
+# the total scanned bytes (archives expand internally).
+StreamMaxLength 2147483648
+MaxFileSize 2147483648
+MaxScanSize 2147483648

deploy/docker-compose.yml

@@ -56,6 +56,11 @@ services:
       CLAMAV_NO_MILTERD: "true"
     volumes:
       - clamav-sigs:/var/lib/clamav
+      # Overlay our clamd.conf so the stream/file/scan size limits are
+      # raised from the image defaults (25 MB / 100 MB / 400 MB) to the
+      # 2 GiB cap Prometheus itself enforces. Without this a 100-MB APK
+      # scan comes back as "INSTREAM size limit exceeded".
+      - ./clamd.conf:/etc/clamav/clamd.conf:ro
     networks:
       - prometheus-internal
     expose: