fix: refuse oversized TIFF/BMP attachments before converting them

A deflate-compressed TIFF under 1 MB can declare 144 million pixels and
take 1.2 GB to convert to PNG, and Pillow only warns below 179 million.
Read the dimensions from the header and refuse images over 40 million
pixels before any pixel data is decoded. Pillow's DecompressionBombError
is now raised as DocumentParseError, so the upload fails once instead of
being retried.

docs/content/Guides/ocr.mdx

@@ -156,7 +156,8 @@ itself is what a model reads. Models that take PDFs get the document; models
 that take only images get its pages as images; a text-only model is told it
 cannot read the file, and the message box warns before sending. Images work
 the same way with OCR off, and TIFF and BMP attachments are stored as PNG,
-since model providers do not accept those formats.
+since model providers do not accept those formats. A TIFF or BMP larger than
+40 million pixels is refused instead of converted.
 
 Mixed documents — text pages with scanned pages among them — convert
 through anydoc, which reads the text pages and skips the scanned ones. With