test: massive test coverage expansion (+1,437 tests, 22 new files)

Expand test coverage across all layers via 14 parallel agents:

Unit tests (3,378 total, +534):
- First-ever AI sidecar tests (157 tests covering bridge lifecycle, all 12 tool modules)
- API route infrastructure (auth, pipeline, batch, settings, teams, roles, audit, api-keys, files, docs)
- Lib coverage improvements (audit 7%->95%, worker-pool 33%->100%)
- Web store/lib gap fills (features-store, tool-registry)

Integration tests (4,403 total, +903):
- Expanded 19 tool test files with parameter variations, format edge cases, boundary values
- Cross-format matrix: 290 tests covering 14 tools x 17 formats
- Adversarial/edge cases: 63 tests for extreme inputs, concurrent requests, corrupted files

E2E-Docker (125 new tests):
- Expanded 8 spec files + 1 new file covering all 49 tools
- Added HEIC/format handling, auth failures, download verification

GUI E2E (expanded 28 spec files):
- Navigation, responsive layout, keyboard shortcuts
- All 51 tool UIs with settings, processing, display modes
- Batch/pipeline workflows, settings/RBAC, visual regression
- Resilience, accessibility (ARIA, contrast, focus), performance budgets

tests/integration/sharpening.test.ts

@@ -500,3 +500,156 @@ describe("SVG input", () => {
     expect(result.downloadUrl).toBeDefined();
   });
 });
+
+// ── TIFF input ─────────────────────────────────────────────────
+describe("TIFF input", () => {
+  it("processes TIFF image with unsharp-mask", async () => {
+    const TIFF = readFileSync(join(FIXTURES, "formats", "sample.tiff"));
+    const res = await postTool(
+      { method: "unsharp-mask", amount: 150 },
+      TIFF,
+      "test.tiff",
+      "image/tiff",
+    );
+    expect(res.statusCode).toBe(200);
+    const result = JSON.parse(res.body);
+    expect(result.downloadUrl).toBeDefined();
+  });
+});
+
+// ── BMP input ──────────────────────────────────────────────────
+describe("BMP input", () => {
+  it("processes BMP image with adaptive sharpening", async () => {
+    const BMP = readFileSync(join(FIXTURES, "formats", "sample.bmp"));
+    const res = await postTool({ method: "adaptive", sigma: 2.0 }, BMP, "test.bmp", "image/bmp");
+    expect(res.statusCode).toBe(200);
+    const result = JSON.parse(res.body);
+    expect(result.downloadUrl).toBeDefined();
+  });
+});
+
+// ── Negative strength rejected ─────────────────────────────────
+describe("Negative strength rejected", () => {
+  it("rejects negative strength value", async () => {
+    const res = await postTool({ method: "high-pass", strength: -1 });
+    expect(res.statusCode).toBe(400);
+  });
+});
+
+// ── Radius out of range ────────────────────────────────────────
+describe("Radius out of range", () => {
+  it("rejects radius below minimum (<0.1)", async () => {
+    const res = await postTool({ method: "unsharp-mask", radius: 0.05 });
+    expect(res.statusCode).toBe(400);
+  });
+
+  it("rejects radius above maximum (>5)", async () => {
+    const res = await postTool({ method: "unsharp-mask", radius: 5.1 });
+    expect(res.statusCode).toBe(400);
+  });
+});
+
+// ── Threshold boundary 0 ───────────────────────────────────────
+describe("Threshold boundary", () => {
+  it("accepts minimum threshold (0)", async () => {
+    const res = await postTool({
+      method: "unsharp-mask",
+      amount: 100,
+      radius: 1.0,
+      threshold: 0,
+    });
+    expect(res.statusCode).toBe(200);
+  });
+
+  it("rejects threshold above maximum (>255)", async () => {
+    const res = await postTool({ method: "unsharp-mask", threshold: 256 });
+    expect(res.statusCode).toBe(400);
+  });
+
+  it("rejects negative threshold", async () => {
+    const res = await postTool({ method: "unsharp-mask", threshold: -1 });
+    expect(res.statusCode).toBe(400);
+  });
+});
+
+// ── Amount boundary ────────────────────────────────────────────
+describe("Amount boundary", () => {
+  it("accepts minimum amount (0)", async () => {
+    const res = await postTool({ method: "unsharp-mask", amount: 0 });
+    expect(res.statusCode).toBe(200);
+  });
+
+  it("rejects negative amount", async () => {
+    const res = await postTool({ method: "unsharp-mask", amount: -1 });
+    expect(res.statusCode).toBe(400);
+  });
+});
+
+// ── All three methods with denoise ─────────────────────────────
+describe("All methods with denoise", () => {
+  it("applies adaptive with strong denoise", async () => {
+    const res = await postTool({
+      method: "adaptive",
+      sigma: 2.0,
+      denoise: "strong",
+    });
+    expect(res.statusCode).toBe(200);
+  });
+
+  it("applies unsharp-mask with light denoise", async () => {
+    const res = await postTool({
+      method: "unsharp-mask",
+      amount: 100,
+      denoise: "light",
+    });
+    expect(res.statusCode).toBe(200);
+  });
+
+  it("applies high-pass with medium denoise", async () => {
+    const res = await postTool({
+      method: "high-pass",
+      strength: 50,
+      kernelSize: 3,
+      denoise: "medium",
+    });
+    expect(res.statusCode).toBe(200);
+  });
+});
+
+// ── Output format preservation ─────────────────────────────────
+describe("Output format preservation", () => {
+  it("preserves JPEG format after sharpening", async () => {
+    const res = await postTool(
+      { method: "unsharp-mask", amount: 200 },
+      JPG,
+      "test.jpg",
+      "image/jpeg",
+    );
+    expect(res.statusCode).toBe(200);
+    const result = JSON.parse(res.body);
+    const dlRes = await app.inject({
+      method: "GET",
+      url: result.downloadUrl,
+      headers: { authorization: `Bearer ${adminToken}` },
+    });
+    const meta = await sharp(dlRes.rawPayload).metadata();
+    expect(meta.format).toBe("jpeg");
+    expect(meta.width).toBe(100);
+    expect(meta.height).toBe(100);
+  });
+
+  it("preserves WebP format after sharpening", async () => {
+    const res = await postTool({ method: "adaptive", sigma: 1.5 }, WEBP, "test.webp", "image/webp");
+    expect(res.statusCode).toBe(200);
+    const result = JSON.parse(res.body);
+    const dlRes = await app.inject({
+      method: "GET",
+      url: result.downloadUrl,
+      headers: { authorization: `Bearer ${adminToken}` },
+    });
+    const meta = await sharp(dlRes.rawPayload).metadata();
+    expect(meta.format).toBe("webp");
+    expect(meta.width).toBe(50);
+    expect(meta.height).toBe(50);
+  });
+});