test: coverage campaign and mutation testing across five packages (#628)

Coverage 83.6 to 87.36% lines, 81.63 to 84.14% branches. Mutation testing across five packages: image-engine 85, media-engine 92, doc-engine 87, shared+enterprise 86, apps/api security and jobs slice. Runs all five lanes weekly. Fixes the silently-broken mutation CI (babel pin), a redact-pdf envelope-shape test bug, an untested enterprise license valid-signature path, and an audit test that only exercised a hand-copied reproduction. Test and config only, no product code changes beyond the babel pin and one test-only oidc export. Full suite: 16,712 pass, 0 fail.

tests/integration/tools/document/rotate-pdf.test.ts

@@ -1,3 +1,4 @@
+import { execFileSync } from "node:child_process";
 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -58,6 +59,44 @@ describe.skipIf(!qpdfAvailable())("rotate-pdf (requires qpdf)", () => {
       writeFileSync(outPath, dl.rawPayload);
       const pages = await qpdfPageCount(outPath);
       expect(pages).toBe(3);
+
+      // Verify pages were actually rotated to the requested 90 degrees.
+      // qpdf 12 --json exposes each page's rotation as a "/Rotate" key.
+      const jsonRaw = execFileSync("qpdf", ["--json", outPath], {
+        encoding: "utf8",
+        maxBuffer: 1 << 24,
+      });
+      const parsed = JSON.parse(jsonRaw) as Record<string, unknown>;
+
+      // Collect every "/Rotate" integer found under the page objects.
+      const rotations: number[] = [];
+      const visit = (node: unknown): void => {
+        if (Array.isArray(node)) {
+          for (const item of node) visit(item);
+          return;
+        }
+        if (node && typeof node === "object") {
+          const obj = node as Record<string, unknown>;
+          const rotate = obj["/Rotate"];
+          if (typeof rotate === "number") rotations.push(rotate);
+          for (const value of Object.values(obj)) visit(value);
+        }
+      };
+      const pageList = (parsed.pages ?? []) as unknown[];
+      visit(pageList);
+
+      if (rotations.length > 0) {
+        // Every rotated page must report the requested 90-degree rotation.
+        expect(rotations.length).toBe(3);
+        for (const rotate of rotations) {
+          expect(rotate).toBe(90);
+        }
+      } else {
+        // Fallback: qpdf nested the rotation elsewhere; assert the raw JSON
+        // carries one "/Rotate": 90 entry per page.
+        const matches = jsonRaw.match(/"\/Rotate":\s*90\b/g) ?? [];
+        expect(matches.length).toBe(3);
+      }
     } finally {
       rmSync(dir, { recursive: true, force: true });
     }