fix(face-validator): verify RIFF and WEBP headers for webp magic bytes

[singhanurag0317-bit]

🐛 Fix: Insecure WebP magic bytes matching in face_validator

Fixes #809

Problem

detect_image_type in python-ai-service/app/services/face_validator.py validated WebP images using only the RIFF magic (first 4 bytes). Any file starting with RIFF — e.g. WAV audio or AVI video — was misidentified as a WebP image.

Change

• face_validator.py: WebP detection now requires both the RIFF signature (bytes 0–3) and the WEBP format header (bytes 8–11). RIFF was removed from the generic magic-bytes dict and checked explicitly, so WAV/AVI/other RIFF containers are no longer accepted as images.

Tests

• New python-ai-service/app/services/test_face_validator.py (6 pytest tests): JPEG/PNG detection, valid RIFF+WEBP detection, and rejection of WAV, AVI, and unknown headers.

Verification

• pytest suite added for the service; runs in CI (python-ai-service/app/services/test_face_validator.py). Python is not available in this local environment, so the tests are unverified locally but follow the repo's existing pytest conventions.

[vercel]

@singhanurag0317-bit is attempting to deploy a commit to the souma9830's projects Team on Vercel.

A member of the Team first needs to authorize it.