[Bug] POST /analyze/zip/ always returns 400 "Invalid ZIP file" for valid uploads #1076

Summary

The /analyze/zip/ endpoint is permanently broken — every valid ZIP upload fails with a 400 "Invalid ZIP file" error, even when the file is a well-formed ZIP.

Root Cause

In backend/app/routers/analyze.py, the uploaded file is read in 64KB chunks into a BytesIO buffer. After the loop completes, the buffer's internal cursor is sitting at the end of the data. The code immediately passes this buffer to zipfile.ZipFile(buffer) without seeking back to position 0 first.

zipfile tries to read the ZIP's end-of-central-directory record from the current cursor position (the end), finds nothing, and raises BadZipFile — which is caught and returned as a 400.

Affected lines: analyze.py ~L238–257

# Current (broken)
buffer = BytesIO()
while chunk := await file.read(64 * 1024):
    buffer.write(chunk)           # cursor ends up at EOF
...
archive = zipfile.ZipFile(buffer) # reads from EOF → BadZipFile

Proposed Fix

Add buffer.seek(0) before passing the buffer to zipfile.ZipFile:

buffer = BytesIO()
while chunk := await file.read(64 * 1024):
    buffer.write(chunk)
buffer.seek(0)                    # ← reset cursor to start
...
archive = zipfile.ZipFile(buffer) # now reads correctly

Expected Behavior

Valid ZIP files are accepted and their source files are analyzed.

Environment

• Backend: FastAPI / Python
• File: backend/app/routers/analyze.py