fix(nightly): qpdf in test image, NUL-byte settings, AI sub-path fuzz exclude (#348)

Third round - the prior fixes unblocked these deeper failures on the nightly:

- Docker E2E: the patches/ fix (#346) let the build finish, so tests now
  run - and fail with 'spawnSync qpdf ENOENT'. Dockerfile.test installed
  imagemagick/ghostscript/exiftool but never qpdf, which the PDF tools and
  fixture-integrity checks need. Add it.
- NUL-byte 500 (real robustness bug Schemathesis found): a settings string
  containing U+0000 hits the jobs.settings jsonb insert and Postgres rejects
  it ('invalid byte sequence for encoding UTF8: 0x00'), 500ing tools like
  html-to-image. Strip NUL bytes from settings before the insert (NUL is
  never meaningful in tool settings). api typecheck passes.
- Schemathesis: the AI exclude (#346) only anchored on the tool id at the
  path end, so AI sub-endpoints like /passport-photo/analyze were still
  fuzzed and 501'd. Extend the regex to allow an optional sub-path.

.github/workflows/nightly.yml

@@ -338,7 +338,7 @@ jobs:
             --url http://localhost:13490 \
             --checks not_a_server_error \
             --include-path-regex "^/api/v1/(tools|health|info)" \
-            --exclude-path-regex "/(remove-background|upscale|blur-faces|erase-object|ocr|ocr-pdf|colorize|enhance-faces|noise-removal|smart-crop|red-eye-removal|restore-photo|passport-photo|transparency-fixer|ai-canvas-expand|transcribe-audio|auto-subtitles|background-replace|blur-background)$" \
+            --exclude-path-regex "/(remove-background|upscale|blur-faces|erase-object|ocr|ocr-pdf|colorize|enhance-faces|noise-removal|smart-crop|red-eye-removal|restore-photo|passport-photo|transparency-fixer|ai-canvas-expand|transcribe-audio|auto-subtitles|background-replace|blur-background)(/[a-z-]+)?$" \
             --max-examples 25 \
             --report junit \
             --report-dir st-report

apps/api/src/jobs/enqueue.ts

@@ -18,6 +18,23 @@ import { POOLS, type Pool, queueName, type ToolJobData, type ToolJobResult } fro
 
 const queueEventsMap = new Map<Pool, QueueEvents>();
 
+/**
+ * Recursively strip NUL (U+0000) bytes from a value. Postgres rejects NUL in
+ * text/jsonb ("invalid byte sequence for encoding UTF8: 0x00"), so a tool whose
+ * settings contain a NUL (e.g. a fuzzed string field) would 500 on the jobs
+ * insert. NUL is never meaningful in tool settings, so drop it.
+ */
+function stripNulBytes<T>(value: T): T {
+  if (typeof value === "string") return value.replace(/\0/g, "") as T;
+  if (Array.isArray(value)) return value.map(stripNulBytes) as T;
+  if (value && typeof value === "object") {
+    const out: Record<string, unknown> = {};
+    for (const [k, v] of Object.entries(value)) out[k] = stripNulBytes(v);
+    return out as T;
+  }
+  return value;
+}
+
 function getQueueEvents(pool: Pool): QueueEvents {
   let qe = queueEventsMap.get(pool);
   if (!qe) {
@@ -110,7 +127,7 @@ export async function enqueueToolJob(data: ToolJobData): Promise<Job<ToolJobData
     type: data.kind,
     status: "queued",
     inputRefs: data.inputRefs,
-    settings: (data.dbSettings ?? data.settings) as Record<string, unknown>,
+    settings: stripNulBytes((data.dbSettings ?? data.settings) as Record<string, unknown>),
   });
 
   // Fire-and-forget: compute deleteAfter from team retention override

docker/Dockerfile.test

@@ -41,6 +41,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     libraw-dev \
     libjxl-tools \
     ghostscript \
+    qpdf \
     && if apt-cache show libx265-199 >/dev/null 2>&1; then \
          apt-get install -y --no-install-recommends libx265-199; \
        elif apt-cache show libx265-209 >/dev/null 2>&1; then \