fix: resolve 5 Sentry production errors (668 total events)

- Filter known client-error noise (rate limit, empty body, unsupported
  media type, content-length mismatch, premature close) from Sentry
  via beforeSend to stop 644 events of non-actionable noise
- Sanitize x-output-filename header to prevent TypeError on non-ASCII
  filenames in optimize-for-web preview (23 events)
- Handle EPIPE on Python dispatcher stdin write with graceful fallback
  to per-request spawning instead of crashing (NODE-W)
- Map EACCES on storage directory/file write to proper 503 status
  instead of generic 500 (NODE-P, 3 events)

apps/api/src/lib/analytics.ts

@@ -39,6 +39,16 @@ export async function initAnalytics(): Promise<void> {
           }
           if (event.exception?.values) {
             for (const ex of event.exception.values) {
+              if (
+                ex.value &&
+                (ex.value.includes("Rate limit exceeded") ||
+                  ex.value.includes("Body cannot be empty") ||
+                  ex.value.includes("Unsupported Media Type") ||
+                  ex.value.includes("Request body size did not match") ||
+                  ex.value.includes("Premature close"))
+              ) {
+                return null;
+              }
               if (ex.value) {
                 ex.value = ex.value
                   .replace(FILE_EXT_PATTERN, ".[REDACTED]")

apps/api/src/lib/file-storage.ts

@@ -56,7 +56,18 @@ let storageReady = false;
 
 export async function ensureStorageDir(): Promise<void> {
   if (storageReady) return;
-  await mkdir(env.FILES_STORAGE_PATH, { recursive: true });
+  try {
+    await mkdir(env.FILES_STORAGE_PATH, { recursive: true });
+  } catch (e) {
+    if (e instanceof Error && (e as NodeJS.ErrnoException).code === "EACCES") {
+      const err = new Error("Storage directory is not writable") as Error & {
+        statusCode: number;
+      };
+      err.statusCode = 503;
+      throw err;
+    }
+    throw e;
+  }
   storageReady = true;
 }
 
@@ -70,7 +81,18 @@ export async function saveFile(buffer: Buffer, originalName: string): Promise<st
     ext = ".bin";
   }
   const storedName = `${randomUUID()}${ext}`;
-  await writeFile(join(env.FILES_STORAGE_PATH, storedName), buffer);
+  try {
+    await writeFile(join(env.FILES_STORAGE_PATH, storedName), buffer);
+  } catch (e) {
+    if (e instanceof Error && (e as NodeJS.ErrnoException).code === "EACCES") {
+      const err = new Error("Storage directory is not writable") as Error & {
+        statusCode: number;
+      };
+      err.statusCode = 503;
+      throw err;
+    }
+    throw e;
+  }
   return storedName;
 }
 

apps/api/src/routes/tools/optimize-for-web.ts

@@ -159,7 +159,8 @@ export function registerOptimizeForWeb(app: FastifyInstance) {
         reply.header("Content-Type", result.contentType);
         reply.header("X-Original-Size", String(fileBuffer.length));
         reply.header("X-Processed-Size", String(result.buffer.length));
-        reply.header("X-Output-Filename", encodeURIComponent(result.filename));
+        const safeFilename = encodeURIComponent(result.filename).replace(/[^ -~]/g, "");
+        reply.header("X-Output-Filename", safeFilename);
         return reply.send(result.buffer);
       } catch (err) {
         const message = err instanceof Error ? err.message : "Preview processing failed";