fix(upload): enforce strict mp4 validation

The inline check accepted application/octet-stream (any file) and used
an unanchored regex so substring MIME types like text/video/mp4 passed.
Route through the existing mediaTypeForUpload helper which does exact
Object.hasOwn matching and extension fallback.

Fixes #53

Author: qwenbona

app/api/upload/route.ts

@@ -4,7 +4,7 @@ import path from "node:path";
 import { readSession, authConfigured, SESSION_COOKIE } from "@/lib/session";
 import { findOrCreateAccountByEmail, ownsParkedDomain, getTenantConfig, upsertTenant } from "@/lib/db";
 import { safeDomain } from "@/lib/config";
-import { ffmpegPoster } from "@/lib/media";
+import { ffmpegPoster, mediaTypeForUpload } from "@/lib/media";
 
 export const runtime = "nodejs";
 export const dynamic = "force-dynamic";
@@ -36,8 +36,7 @@ export async function POST(req: NextRequest) {
   try { form = await req.formData(); } catch { return NextResponse.json({ error: "Bad upload." }, { status: 400 }); }
   const file = form.get("file");
   if (!(file instanceof File)) return NextResponse.json({ error: "No file." }, { status: 400 });
-  const isMp4 = /\.mp4$/i.test(file.name) || /video\/mp4|application\/octet-stream/.test(file.type);
-  if (!isMp4) return NextResponse.json({ error: "MP4 files only." }, { status: 400 });
+  if (!mediaTypeForUpload(file.name, file.type)) return NextResponse.json({ error: "MP4 files only." }, { status: 400 });
   if (file.size > MAX_BYTES) return NextResponse.json({ error: "Too big — 100 MB max." }, { status: 413 });
 
   const dir = path.join(VIDEO_DIR, domSlug(dn));