Pentest 69.3 (INFO): Magic-Byte-Validator auf Vertragsdokumente erweitert

contract.routes.ts Vertragsdokumente-Upload hatte bisher nur den
PDF-Inhalts-Scan aus 68.1. JPG/PNG-Uploads waren ungeprüft, ohne
canonical Rename – Pentester selbst attestiert "ohne Exploit-Pfad"
(Download-Layer fängt's), aber inkonsistent zu allen anderen
Upload-Pfaden.

- Refactor: detectType + validateUploadedFile aus upload.routes.ts
  in neue Middleware uploadFileTypeValidator.ts ausgelagert (Single
  Source of Truth, ~90 Zeilen Duplikation entfällt).
- contract.routes.ts: validateUploadedFile ersetzt
  scanUploadedPdfIfPresent → Magic-Byte + canonical Rename + PDF-Scan
  in einer Pipeline.
- pdfUploadSafety.ts: scanUploadedPdfIfPresent entfernt (tot).

backend/src/routes/contract.routes.ts

@@ -5,7 +5,7 @@ import fs from 'fs';
 import * as contractController from '../controllers/contract.controller.js';
 import * as invoiceController from '../controllers/invoice.controller.js';
 import { authenticate, requirePermission } from '../middleware/auth.js';
-import { scanUploadedPdfIfPresent } from '../middleware/pdfUploadSafety.js';
+import { validateUploadedFile } from '../middleware/uploadFileTypeValidator.js';
 
 const router = Router();
 
@@ -55,7 +55,7 @@ router.post('/:id/invoices', authenticate, requirePermission('contracts:update')
 
 // Vertragsdokumente
 router.get('/:id/documents', authenticate, requirePermission('contracts:read'), contractController.getContractDocuments);
-router.post('/:id/documents', authenticate, requirePermission('contracts:update'), docUpload.single('file'), scanUploadedPdfIfPresent, contractController.uploadContractDocument);
+router.post('/:id/documents', authenticate, requirePermission('contracts:update'), docUpload.single('file'), validateUploadedFile, contractController.uploadContractDocument);
 router.delete('/:id/documents/:documentId', authenticate, requirePermission('contracts:update'), contractController.deleteContractDocument);
 
 // Folgezähler