test: coverage campaign and mutation testing across five packages (#628)

Coverage 83.6 to 87.36% lines, 81.63 to 84.14% branches. Mutation testing across five packages: image-engine 85, media-engine 92, doc-engine 87, shared+enterprise 86, apps/api security and jobs slice. Runs all five lanes weekly. Fixes the silently-broken mutation CI (babel pin), a redact-pdf envelope-shape test bug, an untested enterprise license valid-signature path, and an audit test that only exercised a hand-copied reproduction. Test and config only, no product code changes beyond the babel pin and one test-only oidc export. Full suite: 16,712 pass, 0 fail.

vitest.stryker-shared.config.ts

@@ -0,0 +1,21 @@
+import { defineConfig } from "vitest/config";
+import rootConfig from "./vitest.config";
+
+// Container-free mutation lane for packages/shared (and packages/enterprise).
+// The shared/enterprise unit suites are pure logic, so this drops the
+// testcontainer global-setup and per-fork DB cloning and reuses the root
+// config's alias map. Mirrors vitest.stryker-api.config.ts.
+const rootResolve = (rootConfig as { resolve?: Record<string, unknown> }).resolve;
+
+export default defineConfig({
+  esbuild: { jsx: "automatic" },
+  resolve: rootResolve as never,
+  test: {
+    globals: true,
+    include: ["tests/unit/shared/**/*.test.ts", "tests/unit/api/license-*.test.ts"],
+    setupFiles: ["tests/setup/stryker-api-env.ts"],
+    pool: "forks",
+    testTimeout: 30_000,
+    hookTimeout: 30_000,
+  },
+});