Add security logging for file signature validation failures

[Copilot]

File signature validation was rejecting malicious uploads but not logging failures for security monitoring and incident response.

Changes

• Security logging added - Log file signature validation failures with sanitized metadata (userId, fileSize, mimeType, originalName) for attack pattern detection and incident investigation
• Log injection prevention - Use sanitizeLog utility to strip newlines and redact sensitive fields before logging

Implementation

// Verify file signature (magic bytes)
if (!verifyAudioFileSignature(file.buffer)) {
  console.error("File signature validation failed:", sanitizeLog({
    userId: req.user.claims.sub,
    fileSize: file.size,
    mimeType: file.mimetype,
    originalName: file.originalname
  }));
  return res.status(400).json({ message: "Invalid file signature. Please upload a valid audio file." });
}

This enables security teams to identify upload bypass attempts and investigate suspicious patterns in production logs.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

---

Summary by cubic

Fixes a gap that let users bypass file upload validation and store unsupported or oversized files. The backend now enforces strict type and size checks and returns clear 4xx errors on invalid uploads.

• Bug Fixes
  • Enforce server-side MIME sniffing and extension allowlist.
  • Apply max-size and zero-byte checks; reject mismatched type/extension.
  • Sanitize filenames and block unsafe paths.
  • Return consistent error messages; add tests for common bypass attempts.

^{Written for commit f01ac62. Summary will update on new commits.}