test: coverage campaign and mutation testing across five packages (#628)

Coverage 83.6 to 87.36% lines, 81.63 to 84.14% branches. Mutation testing across five packages: image-engine 85, media-engine 92, doc-engine 87, shared+enterprise 86, apps/api security and jobs slice. Runs all five lanes weekly. Fixes the silently-broken mutation CI (babel pin), a redact-pdf envelope-shape test bug, an untested enterprise license valid-signature path, and an audit test that only exercised a hand-copied reproduction. Test and config only, no product code changes beyond the babel pin and one test-only oidc export. Full suite: 16,712 pass, 0 fail.

apps/api/src/plugins/oidc.ts

@@ -27,6 +27,14 @@ const CACHE_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
 
 let cachedConfig: { config: oidc.Configuration; cachedAt: number } | null = null;
 
+/**
+ * Test hook: clear the module-level discovery cache so a test can force a cold
+ * discovery independent of execution order. Production code never calls this.
+ */
+export function resetOidcDiscoveryCacheForTests(): void {
+  cachedConfig = null;
+}
+
 async function getOrDiscoverConfig(): Promise<oidc.Configuration> {
   if (cachedConfig && Date.now() - cachedConfig.cachedAt < CACHE_TTL_MS) {
     return cachedConfig.config;