The user-specific `max_size` is ignored when it is less than `max_size` from `permission_rules`

For example, `geekless@zeroid.bit` still has `max_size` of 10000 bytes:

```json
{
"user_contents": {
"cert_signers": {
"zeroid.bit": [
"1iD5ZQJMNXu43w1qLB8sfdHVKppVMduGz"
]
},
"permission_rules": {
".*": {
"files_allowed": "data.json",
"max_size": 10000
}
},
"permissions": {
"geekless@zeroid.bit": {
"max_size": 5000
}
}
}
}
```

Shouldn't per-user permissions always take the precedence over permission rules?

The issue provides no file or test entry point; start by locating the handling of permission_rules, per-user permissions, and max_size. Confirm the behavior with the supplied configuration, then ensure the per-user value of 5000 takes precedence over the rule value of 10000 and add or update coverage for that case.

Written by the indexing model from the issue text.