Temporarily disable CSV uploads

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

upload/backend/upload_refs/blueprint.py

@@ -74,6 +74,12 @@ def create_upload_refs_blueprint(cfg: dict = None) -> Blueprint:
         if not refs:
             log.warning("upload_refs: no files, sid=%s", sid)
             return jsonify({"ok": False, "error": "No files"}), 400
+        # Reject CSV refs before pulling any objects. The browser picker also
+        # excludes CSV; this guard covers direct callers of the upload bridge.
+        if any(safe_name(ref.get("name") or "").lower().endswith(".csv") for ref in refs):
+            log.warning("upload_refs: CSV input is disabled, sid=%s", sid)
+            return jsonify({"ok": False, "error": "CSV uploads are temporarily disabled"}), 400
+
         added = 0
         transport = cfg.get("httpxTransport") or current_app.config.get("UPLOAD_HTTPX_TRANSPORT")
         try: