fix(security): close the gaps a full 2.0 re-audit left open (#620)

Follow-up to a full re-audit of the 2.0 tree. Most prior findings were already
fixed; this closes the ones that were not:

- SAML assertion replay: validateInResponseTo ifPresent plus a Redis-backed
  CacheProvider, so a captured signed assertion cannot be replayed. ifPresent
  keeps IdP-initiated SSO working.
- MFA login challenge burned after 5 wrong TOTP codes.
- api_keys.key_prefix indexed; the per-request lookup was a full table scan.
- MAX_AI_JOBS_PER_USER caps a user's in-flight single-file AI jobs (the AI pool
  runs at concurrency 1). Batch and pipeline AI stay uncapped.
- MAX_WORKSPACE_SIZE_GB enforced instead of being dead config.
- SUBPROCESS_MEMORY_LIMIT_MB (default off) for the native media and doc engines;
  not applied to the AI sidecar.
- SVG sanitizer closes unquoted and whitespace-prefixed javascript: hrefs and
  the animateTransform/animateMotion/handler/mpath elements.
- Windows-style paths stripped from error output to match the Sentry scrubber.
- Postgres and Redis compose services get cap_drop plus pids_limit and cpus.
- .env.example ships MAX_SVG_SIZE_MB=50 (0 disabled the cap).

Adds security-focused unit and integration tests. typecheck, biome, and the
full unit and integration suites pass.

packages/shared/src/index.ts

@@ -14,5 +14,6 @@ export * from "./permissions.js";
 export * from "./pipeline-templates.js";
 export * from "./search/format-aliases.js";
 export * from "./section.js";
+export * from "./subprocess-limit.js";
 export * from "./tool-errors.js";
 export * from "./types.js";

packages/shared/src/subprocess-limit.ts

@@ -0,0 +1,26 @@
+/**
+ * Optional per-subprocess address-space cap (RLIMIT_AS) for the native media and
+ * document engines.
+ *
+ * When SUBPROCESS_MEMORY_LIMIT_MB is a positive integer, the command runs under
+ * /bin/sh, which sets `ulimit -v` and then `exec`s the real binary with its exact
+ * argv. `exec "$@"` does not re-parse the arguments through the shell, so this
+ * stays injection-safe. A decompression bomb or runaway filter graph is then
+ * killed at that ceiling instead of driving the whole container to the cgroup
+ * OOM-killer (which would take every in-flight job down with it).
+ *
+ * Disabled by default (unset or 0): the container memory limit remains the
+ * primary backstop, and `ulimit -v` is a blunt instrument (it caps virtual
+ * address space, not RSS). `|| true` makes it a no-op where `ulimit -v` is
+ * unsupported, e.g. macOS.
+ *
+ * Deliberately NOT applied to the Python AI sidecar: ML frameworks (torch, CUDA)
+ * reserve very large virtual address space without touching it, so an RLIMIT_AS
+ * cap would break legitimate model loads. Those rely on the container limit.
+ */
+export function wrapWithMemoryLimit(bin: string, args: string[]): [string, string[]] {
+  const mb = Number.parseInt(process.env.SUBPROCESS_MEMORY_LIMIT_MB ?? "", 10);
+  if (!Number.isFinite(mb) || mb <= 0) return [bin, args];
+  const script = 'ulimit -v "$1" 2>/dev/null || true; shift; exec "$@"';
+  return ["/bin/sh", ["-c", script, "sh", String(mb * 1024), bin, ...args]];
+}