test: expand test coverage across unit, integration, e2e, and e2e-docker suites

Add ~210 new tests filling gaps identified by a comprehensive 14-agent
coverage audit. Unit+integration tests go from 9,388 to 9,484 (all passing).

Unit tests (+36):
- AI bridge: OOM fallback path, custom tier option
- Web lib: api-errors, format date/datetime, tool-i18n coverage

Integration tests (+19):
- Format matrix: ai-canvas-expand and find-duplicates added to cross-format matrix
- Adversarial: SVG XXE attacks, SQL injection in settings, request body size
  limits, race conditions with identical filenames

E2E Docker (+3):
- ai-canvas-expand tool coverage with HEIC input and edge cases

E2E GUI (~150+):
- Navigation: login rate limiting, ai-canvas-expand in parameterized list
- Responsive: dropzone visibility, text readability, dialog bounds at all viewports
- Keyboard: shortcuts verified from automate, files, tool, and fullscreen pages
- Tool UI: undo/state-reset for 16 tools, crop canvas drag handles, rotate/border
  live preview, linked aspect-ratio inputs for resize
- Batch: per-image undo isolation, batch compress/convert/rotate (not just resize)
- Pipeline: tool palette search, step collapse/expand visibility
- Settings: audit log entry verification, system settings persistence, teams CRUD,
  role permission toggling
- RBAC: user/editor 403 on roles/teams endpoints, privilege escalation prevention,
  cross-role tab parity documented as intentional
- Accessibility: skip-to-content link (WCAG 2.4.1), comprehensive color contrast
  for all headings/body/buttons in both themes with DOM-walking background detection
- Resilience: auth expiry 401 redirect, rate limit 429 handling
- Performance: JS heap memory stability for tool navigation, dialog cycling,
  upload/clear cycles, rapid page navigation

tests/e2e/gui-keyboard.spec.ts

@@ -157,6 +157,53 @@ test.describe("Keyboard Shortcuts - Tool Navigation", () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// Shortcuts work from any page
+// ---------------------------------------------------------------------------
+test.describe("Keyboard Shortcuts - Work From Any Page", () => {
+  test("Cmd/Ctrl+Shift+D toggles theme from /automate", async ({ loggedInPage: page }) => {
+    await page.goto("/automate");
+
+    const hadDark = await page.evaluate(() => document.documentElement.classList.contains("dark"));
+
+    await page.keyboard.press(`${MOD}+Shift+d`);
+    await page.waitForTimeout(300);
+
+    const hasDark = await page.evaluate(() => document.documentElement.classList.contains("dark"));
+    expect(hasDark).not.toBe(hadDark);
+  });
+
+  test("Cmd/Ctrl+/ navigates to tools from /files", async ({ loggedInPage: page }) => {
+    await page.goto("/files");
+    await expect(page).toHaveURL("/files");
+
+    await page.keyboard.press(`${MOD}+/`);
+
+    await expect(page).toHaveURL("/");
+  });
+
+  test("Cmd/Ctrl+Alt+1 navigates to Resize from a tool page", async ({ loggedInPage: page }) => {
+    await page.goto("/compress");
+    await expect(page).toHaveURL("/compress");
+
+    await page.keyboard.press(`${MOD}+Alt+1`);
+
+    await expect(page).toHaveURL("/resize");
+  });
+
+  test("Cmd/Ctrl+Shift+D toggles theme from /fullscreen", async ({ loggedInPage: page }) => {
+    await page.goto("/fullscreen");
+
+    const hadDark = await page.evaluate(() => document.documentElement.classList.contains("dark"));
+
+    await page.keyboard.press(`${MOD}+Shift+d`);
+    await page.waitForTimeout(300);
+
+    const hasDark = await page.evaluate(() => document.documentElement.classList.contains("dark"));
+    expect(hasDark).not.toBe(hadDark);
+  });
+});
+
 // ---------------------------------------------------------------------------
 // Keyboard shortcut suppression in different input types
 // ---------------------------------------------------------------------------