Pre-deploy security/correctness fixes (port log E17)

- Remove dead kitchen->KDS internal API (api/internal.py, verify_internal_secret)
  — KDS reads kitchen_db directly (E16), nothing ever called this endpoint
- Add expires_at to dispute_attachments; public attachment links now expire
  after 30 days instead of staying valid forever (A4)
- Add services/upload_validation.py: sniff real file content via python-magic
  instead of trusting the client-supplied Content-Type header, plus a 20MB
  cap. Applied across invoices/logbook/food_flags/credit_notes/disputes
  upload endpoints (A5) — disputes previously had no file-type check at all
- Fix nginx client_max_body_size drift (800m -> the plan's intended 20m)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/main.py

@@ -20,7 +20,6 @@ from api import (
     purchase_orders, cost_distributions, ingredients, recipes, food_flags,
     event_orders, external, menus, reconciliation, kds_settings,
 )
-from api.internal import router as internal_router
 
 from migrations.add_invoice_features import run_migration
 from migrations.add_newbook_tables import run_migration as run_newbook_migration
@@ -74,6 +73,7 @@ from migrations.add_llm_infrastructure import migrate as run_llm_infrastructure_
 from migrations.add_changelog_invoice_link import migrate as run_changelog_invoice_link_migration
 from migrations.add_sambapos_portion_name import migrate as run_sambapos_portion_name_migration
 from migrations.add_global_settings_flags import migrate as run_global_settings_flags_migration
+from migrations.add_dispute_attachment_expiry import run_migration as run_dispute_attachment_expiry_migration
 
 from scheduler import start_scheduler, stop_scheduler
 
@@ -148,6 +148,7 @@ async def lifespan(app: FastAPI):
     await _run("Changelog invoice link", run_changelog_invoice_link_migration)
     await _run("SambaPOS portion name", run_sambapos_portion_name_migration)
     await _run("Global settings flags", run_global_settings_flags_migration)
+    await _run("Dispute attachment expiry", run_dispute_attachment_expiry_migration)
 
     start_scheduler()
 
@@ -197,7 +198,6 @@ app.include_router(event_orders.router, prefix="/api/event-orders", tags=["Event
 app.include_router(menus.router, prefix="/api/menus", tags=["Menus"])
 app.include_router(external.router, prefix="/api/external", tags=["External API"])
 app.include_router(kds_settings.router, prefix="/api/kds", tags=["KDS Settings"])
-app.include_router(internal_router)
 
 
 @app.get("/health")