Pre-deploy security/correctness fixes (port log E17)

- Remove dead kitchen->KDS internal API (api/internal.py, verify_internal_secret)
  — KDS reads kitchen_db directly (E16), nothing ever called this endpoint
- Add expires_at to dispute_attachments; public attachment links now expire
  after 30 days instead of staying valid forever (A4)
- Add services/upload_validation.py: sniff real file content via python-magic
  instead of trusting the client-supplied Content-Type header, plus a 20MB
  cap. Applied across invoices/logbook/food_flags/credit_notes/disputes
  upload endpoints (A5) — disputes previously had no file-type check at all
- Fix nginx client_max_body_size drift (800m -> the plan's intended 20m)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/api/disputes.py

@@ -28,12 +28,16 @@ from models.dispute import (
 from models.invoice import Invoice
 from models.supplier import Supplier
 from services.dispute_archival_service import DisputeArchivalService
+from services.upload_validation import read_and_validate_upload
 
 
 def generate_public_hash() -> str:
     """Generate a secure random hash for public attachment links"""
     return secrets.token_urlsafe(32)  # 43 character URL-safe string
 
+
+PUBLIC_LINK_EXPIRY_DAYS = 30  # A4 — public attachment links must not live forever
+
 router = APIRouter()
 
 
@@ -563,8 +567,13 @@ async def upload_dispute_attachment(
     if not dispute:
         raise HTTPException(status_code=404, detail="Dispute not found")
 
-    # Read file content
-    file_content = await file.read()
+    # Read + validate file content (sniffed, not the client header — A5).
+    # Broad allowlist: photos, PDFs, delivery-note scans and emailed evidence.
+    allowed_types = {
+        "image/jpeg", "image/png", "image/webp", "image/heic",
+        "application/pdf", "message/rfc822",
+    }
+    file_content = await read_and_validate_upload(file, allowed_types)
     file_size = len(file_content)
 
     # Save file
@@ -579,8 +588,9 @@ async def upload_dispute_attachment(
     if not success:
         raise HTTPException(status_code=500, detail=f"Failed to save file: {file_path}")
 
-    # Generate public hash for shareable link
+    # Generate public hash for shareable link (expires — A4)
     public_hash = generate_public_hash()
+    expires_at = datetime.utcnow() + timedelta(days=PUBLIC_LINK_EXPIRY_DAYS)
 
     # Create attachment record
     attachment = DisputeAttachment(
@@ -592,6 +602,7 @@ async def upload_dispute_attachment(
         file_size_bytes=file_size,
         attachment_type=attachment_type,
         description=description,
+        expires_at=expires_at,
         uploaded_by=current_user.id,
         public_hash=public_hash
     )