httpd: make the firmware upload length limit count

max_upload was armed once when the upload began and never reduced, so
`max_upload - uip_len > 0` was an unsigned expression that only went
false when a segment arrived whose length matched the limit exactly. The
write pointer climbed from the staging address with nothing to stop it,
while flash_write_bytes() carries the address in three bytes and drops
whatever does not fit.

Subtract each segment as it is taken and compare before subtracting, which
is what the comment there described. The limit was only ever armed for
firmware uploads; configuration uploads keep the bound their own buffer
already imposes.

httpd/httpd.c

@@ -902,8 +902,9 @@ void httpd_appcall(void)
 			reset_chip();
 		}
 	} else if (uip_newdata() && s->tstate == TSTATE_POST) {
-		// Check here maxupload by subtracting uip_len and close socekt if fails!
-		if (max_upload - uip_len > 0) {
+		if (config_upload || uip_len <= max_upload) {
+			if (!config_upload)
+				max_upload -= uip_len;
 			upload_settings.p = uip_appdata;
 			upload_settings.bptr = 0;
 			upload_settings.plen = uip_len;