Pre-deploy security/correctness fixes (port log E17)

- Remove dead kitchen->KDS internal API (api/internal.py, verify_internal_secret)
  — KDS reads kitchen_db directly (E16), nothing ever called this endpoint
- Add expires_at to dispute_attachments; public attachment links now expire
  after 30 days instead of staying valid forever (A4)
- Add services/upload_validation.py: sniff real file content via python-magic
  instead of trusting the client-supplied Content-Type header, plus a 20MB
  cap. Applied across invoices/logbook/food_flags/credit_notes/disputes
  upload endpoints (A5) — disputes previously had no file-type check at all
- Fix nginx client_max_body_size drift (800m -> the plan's intended 20m)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/api/food_flags.py

@@ -17,6 +17,7 @@ from sqlalchemy.orm import selectinload
 from pydantic import BaseModel
 
 from database import get_db
+from services.upload_validation import read_and_validate_upload
 from models.user import User
 from models.food_flag import FoodFlagCategory, FoodFlag, LineItemFlag, RecipeFlag, RecipeFlagOverride, AllergenKeyword, BrakesProductCache
 from models.ingredient import Ingredient, IngredientFlag, IngredientFlagNone, IngredientFlagDismissal
@@ -1983,10 +1984,9 @@ async def scan_label(
     """OCR a product ingredient label image and suggest allergen flags.
     For create mode (ingredient doesn't exist yet) — returns raw text + suggestions.
     """
-    # Validate file type
+    # Validate file type (sniffed from content, not the client header — A5)
     allowed = {"image/jpeg", "image/png", "image/webp", "image/heic"}
-    if file.content_type not in allowed:
-        raise HTTPException(400, f"Unsupported file type: {file.content_type}")
+    image_bytes = await read_and_validate_upload(file, allowed)
 
     # Get Azure credentials
     settings_result = await db.execute(
@@ -1996,9 +1996,6 @@ async def scan_label(
     if not settings or not settings.azure_endpoint or not settings.azure_key:
         raise HTTPException(400, "Azure Document Intelligence not configured. Set it up in Settings.")
 
-    # Read file content
-    image_bytes = await file.read()
-
     # OCR with Azure prebuilt-read
     try:
         from azure.ai.formrecognizer import DocumentAnalysisClient
@@ -2042,10 +2039,9 @@ async def scan_label_for_ingredient(
     if not ing or ing.kitchen_id != user.kitchen_id:
         raise HTTPException(404, "Ingredient not found")
 
-    # Validate file type
+    # Validate file type (sniffed from content, not the client header — A5)
     allowed = {"image/jpeg", "image/png", "image/webp", "image/heic"}
-    if file.content_type not in allowed:
-        raise HTTPException(400, f"Unsupported file type: {file.content_type}")
+    image_bytes = await read_and_validate_upload(file, allowed)
 
     # Get Azure credentials
     settings_result = await db.execute(
@@ -2055,9 +2051,6 @@ async def scan_label_for_ingredient(
     if not settings or not settings.azure_endpoint or not settings.azure_key:
         raise HTTPException(400, "Azure Document Intelligence not configured. Set it up in Settings.")
 
-    # Read file content
-    image_bytes = await file.read()
-
     # Save label image
     ext = file.filename.rsplit(".", 1)[-1] if file.filename and "." in file.filename else "jpg"
     label_dir = f"/app/data/{user.kitchen_id}/labels"