“Sorry, this file type is not permitted for security reasons.”

Because the problem was not host, theme, or plugin specific, I figured it must be an issue in the database.

On the remote staging site, I dropped all database tables, reran the WordPress setup wizard, enabled plugins, and then imported a WordPress export from the local development site.

I can now upload images, but still don’t know what was preventing me from uploading them originally.

Edit: I can upload some images. The original Photoshop saved/exported JPGs still produce the same error.