fix(security): VULN-009 magic-byte MIME validation + UTC date fix

- uploadEvidenceFile: validate file type via file-type magic bytes, reject
  client-supplied MIME, derive extension from detected type, upload ArrayBuffer
- getEscalationThreshold: use setUTCHours instead of setHours so date-only ISO
  strings (always UTC midnight) compare consistently in any timezone
- Tests: mock file-type, update upload expectation to ArrayBuffer

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CPf5Rc8QPx6V8KLEEgfKEQ

tests/lib/supabase/storage.test.ts

@@ -1,6 +1,10 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest'
 import { uploadEvidenceFile, getEvidenceUrl } from '@/lib/supabase/storage'
 
+vi.mock('file-type', () => ({
+  fileTypeFromBuffer: vi.fn().mockResolvedValue({ mime: 'image/jpeg', ext: 'jpg' }),
+}))
+
 const mockUpload = vi.fn()
 const mockCreateSignedUrl = vi.fn()
 const mockSupabase = {
@@ -26,7 +30,7 @@ describe('uploadEvidenceFile', () => {
     expect(mockSupabase.storage.from).toHaveBeenCalledWith('evidence')
     expect(mockUpload).toHaveBeenCalledWith(
       expect.stringContaining('user-123/incident-abc/report/'),
-      file,
+      expect.any(ArrayBuffer),
       expect.objectContaining({ contentType: 'image/jpeg', upsert: false })
     )
     expect(mockCreateSignedUrl).toHaveBeenCalledWith(expect.stringContaining('user-123/incident-abc/report/'), 315360000)