Fix final validation review findings

docs/validation-parity-checklist.md

@@ -14,8 +14,10 @@ validation framework, state-management mechanism, or dependency.
 - Request validation failures use HTTP 400 and
   `{ "code": "validation_failed", "errors": [{ "field": "...", "code": "..." }] }`.
 - Other safely rejected requests use the stable HTTP 400 code `invalid_request`.
-- Conflicts use HTTP 409, oversized uploads use HTTP 413, unavailable IRL data uses HTTP 503,
-  and unexpected failures use HTTP 500. HTTP 422 is not part of this contract.
+- Conflicts use HTTP 409. Controller-level file limits use structured HTTP 400 `too_large`
+  field errors; multipart requests rejected before controller validation use coded HTTP 413
+  `attachment_too_large`. Unavailable IRL data uses HTTP 503 and unexpected failures use HTTP 500.
+  HTTP 422 is not part of this contract.
 - Angular maps known field/code pairs to French inline guidance. Unknown fields/codes, network
   failures, conflicts without recognized guidance, and unexpected failures retain a safe visible
   operation-level fallback.
@@ -224,8 +226,8 @@ attachment-transfer endpoint or `targetTenantId` request.
       photo.
 - **Photo multipart contract**:
     - Required non-blank `zoneId` parameter and required `file` part.
-    - Supported content: JPEG, PNG, WebP, HEIC, or HEIF, checked against both MIME type and file
-      signature.
+    - Supported content: JPEG, PNG, WebP, HEIC, or HEIF, identified from its content signature
+      rather than filename extension or client-supplied MIME type.
     - The configurable photo limit defaults to 40 MB and is returned by the report response for
       frontend pre-checks.
 - **Finalization multipart contract**: required valid PDF `file` plus JSON `metadata` containing a
@@ -318,7 +320,7 @@ creation, rent-payment recording, and the native condition-photo control.
 Local verification recorded on 2026-07-26:
 
 - Prettier passed for every frontend/documentation file changed since the epic baseline.
-- Frontend lint, application/e2e type checking, production build, and all 330 unit tests passed.
+- Frontend lint, application/e2e type checking, production build, and all 333 unit tests passed.
 - All 36 Playwright journeys passed across mobile, tablet, and desktop viewports.
-- `./mvnw spotless:check verify` passed: 416 unit/web tests, 16 Docker-backed integration tests,
+- `./mvnw spotless:check verify` passed: 417 unit/web tests, 16 Docker-backed integration tests,
   packaging, and coverage checks.