Pre-deploy security/correctness fixes (port log E17)

- Remove dead kitchen->KDS internal API (api/internal.py, verify_internal_secret)
  — KDS reads kitchen_db directly (E16), nothing ever called this endpoint
- Add expires_at to dispute_attachments; public attachment links now expire
  after 30 days instead of staying valid forever (A4)
- Add services/upload_validation.py: sniff real file content via python-magic
  instead of trusting the client-supplied Content-Type header, plus a 20MB
  cap. Applied across invoices/logbook/food_flags/credit_notes/disputes
  upload endpoints (A5) — disputes previously had no file-type check at all
- Fix nginx client_max_body_size drift (800m -> the plan's intended 20m)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/models/dispute.py

@@ -178,6 +178,8 @@ class DisputeAttachment(Base):
 
     # Public sharing - hash for unauthenticated access (e.g., email to suppliers)
     public_hash: Mapped[str | None] = mapped_column(String(64), nullable=True, unique=True, index=True)
+    # Expiry for the public_hash link — A4: links must not stay valid forever
+    expires_at: Mapped[datetime | None] = mapped_column(DateTime, nullable=True)
 
     # File storage (following Invoice model pattern)
     file_storage_location: Mapped[str] = mapped_column(String(20), default="local")  # "local" or "nextcloud"