fix: Upload-Sanitizing, atomare Import-Reihenfolge, idempotentes UNBEKANNT-Konto

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

finance/app/routers/imports.py

@@ -1,5 +1,6 @@
 from datetime import date
 from decimal import Decimal
+from pathlib import Path
 
 from fastapi import APIRouter, Depends, HTTPException, UploadFile
 from pydantic import BaseModel, ConfigDict
@@ -55,10 +56,13 @@ class PreviewOut(BaseModel):
 
 @router.post("/upload", response_model=StatementOut, status_code=201)
 def upload(file: UploadFile, session: Session = Depends(get_session)):
+    safe_name = Path(file.filename or "upload.pdf").name
+    if not safe_name or not safe_name.lower().endswith(".pdf"):
+        raise HTTPException(400, "Nur PDF-Dateien")
     settings = get_settings()
     inbox_dir = settings.inbox_dir
     inbox_dir.mkdir(parents=True, exist_ok=True)
-    dest = inbox_dir / file.filename
+    dest = inbox_dir / safe_name
     with dest.open("wb") as f:
         f.write(file.file.read())
     stmt = process_pdf(session, dest)