Pre-deploy security/correctness fixes (port log E17)

- Remove dead kitchen->KDS internal API (api/internal.py, verify_internal_secret)
  — KDS reads kitchen_db directly (E16), nothing ever called this endpoint
- Add expires_at to dispute_attachments; public attachment links now expire
  after 30 days instead of staying valid forever (A4)
- Add services/upload_validation.py: sniff real file content via python-magic
  instead of trusting the client-supplied Content-Type header, plus a 20MB
  cap. Applied across invoices/logbook/food_flags/credit_notes/disputes
  upload endpoints (A5) — disputes previously had no file-type check at all
- Fix nginx client_max_body_size drift (800m -> the plan's intended 20m)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/api/credit_notes.py

@@ -23,6 +23,7 @@ from models.dispute import CreditNote, InvoiceDispute, DisputeStatus, DisputeAct
 from models.invoice import Invoice
 from models.supplier import Supplier
 from services.dispute_archival_service import DisputeArchivalService
+from services.upload_validation import read_and_validate_upload
 
 router = APIRouter()
 
@@ -83,12 +84,8 @@ async def upload_credit_note(
     except ValueError:
         raise HTTPException(status_code=400, detail="Invalid date format. Use YYYY-MM-DD")
 
-    # Read file content
-    file_content = await file.read()
-
-    # Validate file type (should be PDF)
-    if file.content_type and "pdf" not in file.content_type.lower():
-        raise HTTPException(status_code=400, detail="Only PDF files are supported for credit notes")
+    # Read + validate file content (sniffed, not the client header — A5)
+    file_content = await read_and_validate_upload(file, {"application/pdf"})
 
     # Save file
     archival_service = DisputeArchivalService(db, current_user.kitchen_id)