test: add backend security regression test foundation

JobTrackerApi.Tests/AttachmentsControllerTests.cs

@@ -0,0 +1,23 @@
+using System.Reflection;
+using JobTrackerApi.Controllers;
+using Xunit;
+
+namespace JobTrackerApi.Tests;
+
+public sealed class AttachmentsControllerTests
+{
+    [Fact]
+    public void Allowed_extensions_include_common_document_and_image_formats()
+    {
+        var field = typeof(AttachmentsController).GetField("AllowedExtensions", BindingFlags.NonPublic | BindingFlags.Static);
+        Assert.NotNull(field);
+
+        var allowed = Assert.IsAssignableFrom<System.Collections.IEnumerable>(field!.GetValue(null));
+        var values = allowed.Cast<string>().ToHashSet(StringComparer.OrdinalIgnoreCase);
+
+        Assert.Contains(".pdf", values);
+        Assert.Contains(".docx", values);
+        Assert.Contains(".png", values);
+        Assert.DoesNotContain(".exe", values);
+    }
+}