Harden PDF validation against renamed files

[saurabhhhcodes]

What changed

• Moved PDF validation to a shared byte-level check instead of trusting the uploaded filename alone.
• Updated the PDF protection and merge routes to pass the file object into the shared validator.
• Kept the existing extension check as an extra guard, but now the file must also present a real PDF header before processing.

Why

• Closes a security gap where a renamed non-PDF file could bypass extension-based validation.
• Prevents the backend from handing obviously invalid uploads to PDF processing code.

Validation

• python3 -m py_compile backend/utils/validators.py backend/blueprints/protect_pdf.py backend/blueprints/merge_pdf.py backend/blueprints/pdf.py backend/blueprints/pdf_info.py backend/blueprints/sign.py
• git diff --check

Closes #330

[vercel]

Someone is attempting to deploy a commit to the Durgeshwar's projects Team on Vercel.

A member of the Team first needs to authorize it.

[Durgeshwar-AI]

@saurabhhhcodes I won't be accepting it unless the issue has been assigned to you.