Missing .aac/.wma magic byte validation in security.py

[AshayK003]

Problem

_FILE_SIGNATURES in security.py:148-155 doesn't include .aac or .wma, even though ALLOWED_AUDIO_EXTENSIONS lists them.

Solution

Add magic byte signatures or remove these extensions from ALLOWED_AUDIO_EXTENSIONS.

Acceptance Criteria

• All allowed audio extensions have corresponding magic byte validation

Difficulty: Easy