Pre-deploy security/correctness fixes (port log E17)

- Remove dead kitchen->KDS internal API (api/internal.py, verify_internal_secret)
  — KDS reads kitchen_db directly (E16), nothing ever called this endpoint
- Add expires_at to dispute_attachments; public attachment links now expire
  after 30 days instead of staying valid forever (A4)
- Add services/upload_validation.py: sniff real file content via python-magic
  instead of trusting the client-supplied Content-Type header, plus a 20MB
  cap. Applied across invoices/logbook/food_flags/credit_notes/disputes
  upload endpoints (A5) — disputes previously had no file-type check at all
- Fix nginx client_max_body_size drift (800m -> the plan's intended 20m)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/auth.py

@@ -108,14 +108,6 @@ async def get_admin_user(user=Depends(get_current_user)):
     return user
 
 
-def verify_internal_secret(authorization: Optional[str] = Header(None)) -> None:
-    """Verify STACK_INTERNAL_SECRET for inter-app calls (e.g. KDS bookings feed)."""
-    if not STACK_INTERNAL_SECRET:
-        raise HTTPException(status_code=status.HTTP_503_SERVICE_UNAVAILABLE, detail="Internal secret not configured")
-    if not authorization or authorization != f"Bearer {STACK_INTERNAL_SECRET}":
-        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Invalid internal secret")
-
-
 # ─── API KEY AUTH (public/external API) ──────────────────────────────────────
 
 def generate_api_key() -> tuple[str, str, str]: