Pre-deploy security/correctness fixes (port log E17)

- Remove dead kitchen->KDS internal API (api/internal.py, verify_internal_secret)
  — KDS reads kitchen_db directly (E16), nothing ever called this endpoint
- Add expires_at to dispute_attachments; public attachment links now expire
  after 30 days instead of staying valid forever (A4)
- Add services/upload_validation.py: sniff real file content via python-magic
  instead of trusting the client-supplied Content-Type header, plus a 20MB
  cap. Applied across invoices/logbook/food_flags/credit_notes/disputes
  upload endpoints (A5) — disputes previously had no file-type check at all
- Fix nginx client_max_body_size drift (800m -> the plan's intended 20m)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/api/public.py

@@ -5,6 +5,7 @@ These endpoints are designed for sharing with external parties (e.g., suppliers)
 via hash-based URLs that don't require login.
 """
 import os
+from datetime import datetime
 from fastapi import APIRouter, HTTPException
 from fastapi.responses import Response
 from sqlalchemy.ext.asyncio import AsyncSession
@@ -39,6 +40,10 @@ async def get_public_attachment(
     if not attachment:
         raise HTTPException(status_code=404, detail="Attachment not found")
 
+    # A4 — public links expire; don't serve a stale/leaked link forever
+    if attachment.expires_at and attachment.expires_at < datetime.utcnow():
+        raise HTTPException(status_code=410, detail="This link has expired")
+
     # Get file content
     content = None
 
@@ -108,11 +113,15 @@ async def get_public_attachment_info(
     if not attachment:
         raise HTTPException(status_code=404, detail="Attachment not found")
 
+    if attachment.expires_at and attachment.expires_at < datetime.utcnow():
+        raise HTTPException(status_code=410, detail="This link has expired")
+
     return {
         "file_name": attachment.file_name,
         "file_type": attachment.file_type,
         "file_size_bytes": attachment.file_size_bytes,
         "attachment_type": attachment.attachment_type,
         "description": attachment.description,
-        "uploaded_at": attachment.uploaded_at.isoformat() if attachment.uploaded_at else None
+        "uploaded_at": attachment.uploaded_at.isoformat() if attachment.uploaded_at else None,
+        "expires_at": attachment.expires_at.isoformat() if attachment.expires_at else None
     }