fix(security): close the gaps a full 2.0 re-audit left open (#620)

Follow-up to a full re-audit of the 2.0 tree. Most prior findings were already
fixed; this closes the ones that were not:

- SAML assertion replay: validateInResponseTo ifPresent plus a Redis-backed
  CacheProvider, so a captured signed assertion cannot be replayed. ifPresent
  keeps IdP-initiated SSO working.
- MFA login challenge burned after 5 wrong TOTP codes.
- api_keys.key_prefix indexed; the per-request lookup was a full table scan.
- MAX_AI_JOBS_PER_USER caps a user's in-flight single-file AI jobs (the AI pool
  runs at concurrency 1). Batch and pipeline AI stay uncapped.
- MAX_WORKSPACE_SIZE_GB enforced instead of being dead config.
- SUBPROCESS_MEMORY_LIMIT_MB (default off) for the native media and doc engines;
  not applied to the AI sidecar.
- SVG sanitizer closes unquoted and whitespace-prefixed javascript: hrefs and
  the animateTransform/animateMotion/handler/mpath elements.
- Windows-style paths stripped from error output to match the Sentry scrubber.
- Postgres and Redis compose services get cap_drop plus pids_limit and cpus.
- .env.example ships MAX_SVG_SIZE_MB=50 (0 disabled the cap).

Adds security-focused unit and integration tests. typecheck, biome, and the
full unit and integration suites pass.

tests/unit/security/security-svg-sanitize.test.ts

@@ -312,6 +312,59 @@ describe("SVG sanitizer -- url() scheme blocking", () => {
   });
 });
 
+// ── href scheme obfuscation: whitespace + unquoted (defense-in-depth) ────────
+
+describe("SVG sanitizer -- href scheme whitespace/unquoted bypass", () => {
+  it("blocks an unquoted javascript: URI in href", () => {
+    const svg = wrapSvg("<a href=javascript:alert(1)><text>x</text></a>");
+    const result = sanitize(svg);
+    expect(result).not.toContain("javascript:");
+  });
+
+  it("blocks a javascript: URI with leading whitespace inside quotes", () => {
+    const svg = wrapSvg('<a href="   javascript:alert(1)"><text>x</text></a>');
+    const result = sanitize(svg);
+    expect(result).not.toContain("javascript:");
+  });
+
+  it("blocks javascript: on xlink:href", () => {
+    const svg = wrapSvg(
+      '<a xlink:href="javascript:alert(1)"><text>x</text></a>',
+      'xmlns:xlink="http://www.w3.org/1999/xlink"',
+    );
+    const result = sanitize(svg);
+    expect(result).not.toContain("javascript:");
+  });
+});
+
+// ── Extended animation / event elements ──────────────────────────────────────
+
+describe("SVG sanitizer -- extended animation elements", () => {
+  it("strips <animateTransform> with a javascript: value", () => {
+    const svg = wrapSvg('<animateTransform attributeName="transform" to="javascript:alert(1)"/>');
+    const result = sanitize(svg);
+    expect(result).not.toContain("<animateTransform");
+    expect(result).not.toContain("javascript:");
+  });
+
+  it("strips <animateMotion> and its <mpath>", () => {
+    const svg = wrapSvg('<animateMotion><mpath href="#p"/></animateMotion>');
+    const result = sanitize(svg);
+    expect(result).not.toContain("<animateMotion");
+    expect(result).not.toContain("<mpath");
+  });
+
+  it("strips the <handler> SVG-Tiny event-handler element", () => {
+    const svg = wrapSvg(
+      '<handler ev:event="load">alert(1)</handler>',
+      'xmlns:ev="http://www.w3.org/2001/xml-events"',
+    );
+    const result = sanitize(svg);
+    expect(result).not.toContain("<handler");
+    expect(result).not.toContain("alert(1)");
+  });
+});
+
 // ── Clean SVGs pass through ──────────────────────────────────────────────────
 
 describe("SVG sanitizer -- clean SVGs pass through", () => {