Pre-deploy security/correctness fixes (port log E17)

- Remove dead kitchen->KDS internal API (api/internal.py, verify_internal_secret)
  — KDS reads kitchen_db directly (E16), nothing ever called this endpoint
- Add expires_at to dispute_attachments; public attachment links now expire
  after 30 days instead of staying valid forever (A4)
- Add services/upload_validation.py: sniff real file content via python-magic
  instead of trusting the client-supplied Content-Type header, plus a 20MB
  cap. Applied across invoices/logbook/food_flags/credit_notes/disputes
  upload endpoints (A5) — disputes previously had no file-type check at all
- Fix nginx client_max_body_size drift (800m -> the plan's intended 20m)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/api/invoices.py

@@ -23,6 +23,7 @@ from auth import get_current_user, require_cap, get_current_user_from_token
 from ocr.extractor import process_invoice_image
 from ocr.azure_extractor import parse_pack_size
 from services.duplicate_detector import DuplicateDetector
+from services.upload_validation import read_and_validate_upload
 
 router = APIRouter()
 logger = logging.getLogger(__name__)
@@ -526,12 +527,8 @@ async def upload_invoice(
     db: AsyncSession = Depends(get_db)
 ):
     """Upload an invoice image or PDF for OCR processing"""
-    allowed_types = ["image/jpeg", "image/png", "image/webp", "image/heic", "application/pdf"]
-    if file.content_type not in allowed_types:
-        raise HTTPException(
-            status_code=400,
-            detail=f"File type not allowed. Allowed: {allowed_types}"
-        )
+    allowed_types = {"image/jpeg", "image/png", "image/webp", "image/heic", "application/pdf"}
+    content = await read_and_validate_upload(file, allowed_types)
 
     ext = file.filename.split(".")[-1] if file.filename else "jpg"
     filename = f"{uuid.uuid4()}.{ext}"
@@ -540,7 +537,6 @@ async def upload_invoice(
     os.makedirs(os.path.dirname(filepath), exist_ok=True)
 
     async with aiofiles.open(filepath, "wb") as f:
-        content = await file.read()
         await f.write(content)
 
     invoice = Invoice(