Pre-deploy security/correctness fixes (port log E17)

- Remove dead kitchen->KDS internal API (api/internal.py, verify_internal_secret)
  — KDS reads kitchen_db directly (E16), nothing ever called this endpoint
- Add expires_at to dispute_attachments; public attachment links now expire
  after 30 days instead of staying valid forever (A4)
- Add services/upload_validation.py: sniff real file content via python-magic
  instead of trusting the client-supplied Content-Type header, plus a 20MB
  cap. Applied across invoices/logbook/food_flags/credit_notes/disputes
  upload endpoints (A5) — disputes previously had no file-type check at all
- Fix nginx client_max_body_size drift (800m -> the plan's intended 20m)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/api/logbook.py

@@ -14,6 +14,7 @@ import logging
 
 from auth import get_current_user, require_cap
 from database import get_db
+from services.upload_validation import read_and_validate_upload
 from models.user import User
 from models.logbook import (
     LogbookEntry, LogbookLineItem, LogbookAttachment,
@@ -670,10 +671,9 @@ async def upload_attachment(
     if not entry:
         raise HTTPException(status_code=404, detail="Entry not found")
 
-    # Validate file type
-    allowed_types = ["image/jpeg", "image/png", "image/heic", "image/webp", "application/pdf"]
-    if file.content_type not in allowed_types:
-        raise HTTPException(status_code=400, detail=f"File type {file.content_type} not allowed. Allowed: {allowed_types}")
+    # Validate file type (sniffed from content, not the client header — A5)
+    allowed_types = {"image/jpeg", "image/png", "image/heic", "image/webp", "application/pdf"}
+    content = await read_and_validate_upload(file, allowed_types)
 
     # Save file
     upload_dir = f"/app/attachments/logbook/kitchen_{current_user.kitchen_id}"
@@ -684,7 +684,6 @@ async def upload_attachment(
     file_name = f"entry_{entry_id}_{timestamp}{file_extension}"
     file_path = f"{upload_dir}/{file_name}"
 
-    content = await file.read()
     with open(file_path, "wb") as f:
         f.write(content)