feat: add file type validation to upload endpoint

- Validate filename ends with .csv (case-insensitive)
- Validate MIME type is text/* or application/csv or text/csv
- Return HTTP 400 with error message if validation fails
- Mark task 2.4 as complete

src/app/api/upload/route.ts

@@ -36,6 +36,24 @@ export async function POST(request: NextRequest): Promise<NextResponse> {
       );
     }
 
+    // Validate file type
+    const fileName = file.name.toLowerCase();
+    if (!fileName.endsWith('.csv')) {
+      return NextResponse.json(
+        { error: 'Invalid file type. Only CSV files are accepted.' },
+        { status: 400 }
+      );
+    }
+
+    const mimeType = file.type;
+    const isValidMimeType = mimeType.startsWith('text/') || mimeType === 'application/csv' || mimeType === 'text/csv';
+    if (!isValidMimeType) {
+      return NextResponse.json(
+        { error: 'Invalid file type. Only CSV files are accepted.' },
+        { status: 400 }
+      );
+    }
+
     const MAX_FILE_SIZE = 10 * 1024 * 1024; // 10MB
     if (file.size > MAX_FILE_SIZE) {
       return NextResponse.json(