fix(nightly): qpdf in test image, NUL-byte settings, AI sub-path fuzz exclude (#348)

Third round - the prior fixes unblocked these deeper failures on the nightly:

- Docker E2E: the patches/ fix (#346) let the build finish, so tests now
  run - and fail with 'spawnSync qpdf ENOENT'. Dockerfile.test installed
  imagemagick/ghostscript/exiftool but never qpdf, which the PDF tools and
  fixture-integrity checks need. Add it.
- NUL-byte 500 (real robustness bug Schemathesis found): a settings string
  containing U+0000 hits the jobs.settings jsonb insert and Postgres rejects
  it ('invalid byte sequence for encoding UTF8: 0x00'), 500ing tools like
  html-to-image. Strip NUL bytes from settings before the insert (NUL is
  never meaningful in tool settings). api typecheck passes.
- Schemathesis: the AI exclude (#346) only anchored on the tool id at the
  path end, so AI sub-endpoints like /passport-photo/analyze were still
  fuzzed and 501'd. Extend the regex to allow an optional sub-path.

.github/workflows/nightly.yml

@@ -338,7 +338,7 @@ jobs:
             --url http://localhost:13490 \
             --checks not_a_server_error \
             --include-path-regex "^/api/v1/(tools|health|info)" \
-            --exclude-path-regex "/(remove-background|upscale|blur-faces|erase-object|ocr|ocr-pdf|colorize|enhance-faces|noise-removal|smart-crop|red-eye-removal|restore-photo|passport-photo|transparency-fixer|ai-canvas-expand|transcribe-audio|auto-subtitles|background-replace|blur-background)$" \
+            --exclude-path-regex "/(remove-background|upscale|blur-faces|erase-object|ocr|ocr-pdf|colorize|enhance-faces|noise-removal|smart-crop|red-eye-removal|restore-photo|passport-photo|transparency-fixer|ai-canvas-expand|transcribe-audio|auto-subtitles|background-replace|blur-background)(/[a-z-]+)?$" \
             --max-examples 25 \
             --report junit \
             --report-dir st-report