fix(security): comprehensive security audit and hardening

Auth: login rate limit 30/min (was 500), global rate limit 1000/min (was
unlimited), password/username max lengths on all Zod schemas, session
invalidation on role change, API key legacy scan bounded to 100 keys.

SVG: hardened regex sanitizer with CDATA stripping, XML entity decoding,
set/animate/iframe/embed blocking, comprehensive data: URI blocking,
use element external href blocking. 11 attack payload fixtures added.

SSRF: fixed DNS rebinding TOCTOU by pinning resolved IPs via custom
HTTP/HTTPS agents. Added 6to4 and NAT64 to blocked IPv6 ranges.

Docker: capability dropping (cap_drop ALL + minimal cap_add), resource
limits (4g/8g mem, 512/1024 pids), healthcheck timeout, password
removed from startup banner, default password warning comments.

Network: CSP and HSTS applied in all environments (not just production),
stack traces removed from all error responses, internal paths stripped
from error details, per-route rate limits on uploads (60/min) and URL
fetches (200/hour).

Files: exclusive temp file creation (O_EXCL), disk space circuit
breaker, per-user storage quotas, settings payload 64KB size guard.

Python sidecar: script name allowlist in dispatcher, minimal environment
for subprocess spawns.

Dependencies: fixed 6 production CVEs (drizzle-orm, fastify, fast-uri,
@fastify/static, next, archiver/lodash). Pinned all GitHub Actions to
SHA hashes.

114 security tests added. Full OWASP Top 10 penetration test matrix
verified against production Docker container (30/30 pass after
hardening).

tests/unit/security-file-processing.test.ts

@@ -0,0 +1,71 @@
+import { randomUUID } from "node:crypto";
+import { constants } from "node:fs";
+import { open, rm, stat } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, expect, it } from "vitest";
+
+/**
+ * Helper that mirrors the writeTempExclusive pattern used in
+ * format-decoders.ts and heic-converter.ts.
+ */
+async function writeTempExclusive(filePath: string, buffer: Buffer): Promise<void> {
+  const fh = await open(filePath, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY);
+  try {
+    await fh.writeFile(buffer);
+  } finally {
+    await fh.close();
+  }
+}
+
+describe("Temp file exclusive creation (O_EXCL)", () => {
+  it("creates a new temp file successfully", async () => {
+    const filePath = join(tmpdir(), `test-excl-${randomUUID()}.tmp`);
+    try {
+      await writeTempExclusive(filePath, Buffer.from("test data"));
+      const info = await stat(filePath);
+      expect(info.size).toBe(9);
+    } finally {
+      await rm(filePath, { force: true }).catch(() => {});
+    }
+  });
+
+  it("fails if the file already exists (prevents overwrite)", async () => {
+    const filePath = join(tmpdir(), `test-excl-${randomUUID()}.tmp`);
+    try {
+      // Create the file first
+      await writeTempExclusive(filePath, Buffer.from("original"));
+      // Attempting to write again should fail with EEXIST
+      await expect(writeTempExclusive(filePath, Buffer.from("overwrite"))).rejects.toThrow();
+      // Verify original content is preserved
+      const fh = await open(filePath, constants.O_RDONLY);
+      try {
+        const buf = await fh.readFile();
+        expect(buf.toString("utf-8")).toBe("original");
+      } finally {
+        await fh.close();
+      }
+    } finally {
+      await rm(filePath, { force: true }).catch(() => {});
+    }
+  });
+
+  it("cleans up in finally blocks even after write failure", async () => {
+    const filePath = join(tmpdir(), `test-excl-${randomUUID()}.tmp`);
+    // Pre-create to force the exclusive open to fail
+    await writeTempExclusive(filePath, Buffer.from("existing"));
+    try {
+      try {
+        await writeTempExclusive(filePath, Buffer.from("new"));
+      } catch {
+        // Expected failure
+      }
+      // Cleanup should still work
+      await rm(filePath, { force: true });
+      await expect(stat(filePath)).rejects.toThrow();
+    } finally {
+      // Ensure cleanup in case test itself fails
+      await rm(filePath, { force: true }).catch(() => {});
+    }
+  });
+});