test: coverage campaign and mutation testing across five packages (#628)

Coverage 83.6 to 87.36% lines, 81.63 to 84.14% branches. Mutation testing across five packages: image-engine 85, media-engine 92, doc-engine 87, shared+enterprise 86, apps/api security and jobs slice. Runs all five lanes weekly. Fixes the silently-broken mutation CI (babel pin), a redact-pdf envelope-shape test bug, an untested enterprise license valid-signature path, and an audit test that only exercised a hand-copied reproduction. Test and config only, no product code changes beyond the babel pin and one test-only oidc export. Full suite: 16,712 pass, 0 fail.

tests/integration/tools/video/video-to-gif.test.ts

@@ -1,4 +1,5 @@
 import { ffmpegAvailable } from "@snapotter/media-engine";
+import sharp from "sharp";
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 import { fixtures, readFixture } from "../../../fixtures/index.js";
 import {
@@ -50,7 +51,8 @@ describe.skipIf(!ffmpegAvailable())("video-to-gif (requires ffmpeg)", () => {
     const { jobId } = JSON.parse(res.body);
     const row = await pollJob(jobId);
     expect(row?.status).toBe("completed");
-    const outName = (row?.outputRefs as string[])[0].split("/").pop() as string;
+    const outputRefs = (row?.outputRefs ?? []) as string[];
+    const outName = outputRefs[0].split("/").pop() as string;
     expect(outName.endsWith(".gif")).toBe(true);
     const dl = await testApp.app.inject({
       method: "GET",
@@ -60,5 +62,10 @@ describe.skipIf(!ffmpegAvailable())("video-to-gif (requires ffmpeg)", () => {
     // GIF files start with GIF8 magic bytes
     const magic = dl.rawPayload.subarray(0, 4).toString("ascii");
     expect(magic).toBe("GIF8");
+    // Decode the payload and confirm it is an animated GIF at the requested width.
+    const meta = await sharp(dl.rawPayload, { animated: true }).metadata();
+    expect(meta.format).toBe("gif");
+    expect(meta.width).toBe(120);
+    expect((meta.pages ?? 1) > 1).toBe(true);
   }, 90_000);
 });