feat: accept JPG/JPEG uploads alongside PDF (full pipeline support)

[Akash29g]

What

Extends the invoice upload pipeline to accept .jpg / .jpeg files in addition to .pdf.
End-to-end: file picker → S3 presigned PUT → GuardDuty gate → magic-byte gate →
Bedrock extraction (image block) → validation → persistence.

Why

Currently only PDF invoices are accepted. JPEG scans of invoices are common
(phone photos, scanner outputs) and Amazon Bedrock Nova supports image extraction
natively — no additional cost or infra change needed.

Changes

Backend

File	Change
UploadService.cs	Added AllowedExtensions + MimeTypes static dicts; replaced PDF-only check; dynamic contentType passed to presigned URL; FileType set from extension.
IInvoiceExtractor.cs	Added fileType parameter ("pdf" | "jpeg") to ExtractAsync.
NovaInvoiceExtractor.cs	Detects file type; uses ImageBlock (JPEG) or DocumentBlock (PDF) accordingly in the Bedrock Converse request.
ExtractionWorker.cs	Magic-byte gate now checks both %PDF- (PDF) and FF D8 FF (JPEG); passes detectedType to extractor; updated error message.
DocAnalytics.Service.csproj	Pinned Microsoft.IdentityModel.Protocols + Protocols.OpenIdConnect to 8.20.0 (pre-existing version-mismatch warning from Dependabot JWT bump).

Frontend

File	Change
upload.component.html	accept → .pdf,.jpg,.jpeg,.zip; updated hint text.
upload.component.ts	Extension checks in expandToPdfs() allow JPEG; dynamic MIME type when constructing File from ZIP entries.
upload.service.ts	S3 PUT uses file.type instead of hardcoded application/pdf.

Tests

• Added CreateUploadAsync_accepts_jpg_file and CreateUploadAsync_accepts_jpeg_extension.

Behaviour notes

• JPEG extraction succeeds end-to-end; confidence may be lower than PDF (60% vs 98%)
  because Nova reads JPEGs visually (OCR) vs PDF text-layer. The validator's
  ERR_BEDROCK_LOWCONF gate applies equally to both — this is correct behaviour.
• GuardDuty malware scan and magic-byte check both work for JPEG.
• S3 presigned URL is signed with the correct MIME type (image/jpeg) and the browser
  PUT now sends the matching Content-Type header.

Checklist

• No schema migration needed
• All existing tests passing
• New JPG acceptance tests added
• PDF flow unaffected (confirmed locally)
• Cross-review (CODEOWNERS)