Pre-deploy security/correctness fixes (port log E17)

- Remove dead kitchen->KDS internal API (api/internal.py, verify_internal_secret)
  — KDS reads kitchen_db directly (E16), nothing ever called this endpoint
- Add expires_at to dispute_attachments; public attachment links now expire
  after 30 days instead of staying valid forever (A4)
- Add services/upload_validation.py: sniff real file content via python-magic
  instead of trusting the client-supplied Content-Type header, plus a 20MB
  cap. Applied across invoices/logbook/food_flags/credit_notes/disputes
  upload endpoints (A5) — disputes previously had no file-type check at all
- Fix nginx client_max_body_size drift (800m -> the plan's intended 20m)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/migrations/add_dispute_attachment_expiry.py

@@ -0,0 +1,35 @@
+"""
+Migration to add expires_at to dispute_attachments.
+
+Public attachment links (public_hash — see add_dispute_attachment_public_hash)
+were valid forever with no expiry, so a leaked/forwarded supplier link stayed
+live indefinitely. See port log A4.
+"""
+import logging
+from sqlalchemy import text
+from database import engine
+
+logger = logging.getLogger(__name__)
+
+
+async def run_migration():
+    """Add expires_at column to dispute_attachments"""
+    async with engine.begin() as conn:
+        result = await conn.execute(text("""
+            SELECT EXISTS (
+                SELECT 1 FROM information_schema.columns
+                WHERE table_name = 'dispute_attachments'
+                AND column_name = 'expires_at'
+            );
+        """))
+        exists = result.scalar()
+
+        if not exists:
+            logger.info("Adding 'expires_at' column to dispute_attachments table")
+            await conn.execute(text("""
+                ALTER TABLE dispute_attachments
+                ADD COLUMN IF NOT EXISTS expires_at TIMESTAMP;
+            """))
+            logger.info("Successfully added 'expires_at' column")
+        else:
+            logger.info("'expires_at' column already exists in dispute_attachments")