backend/app.py: File upload endpoint missing MIME type and extension validation