test: massive test coverage expansion (+1,437 tests, 22 new files)

Expand test coverage across all layers via 14 parallel agents:

Unit tests (3,378 total, +534):
- First-ever AI sidecar tests (157 tests covering bridge lifecycle, all 12 tool modules)
- API route infrastructure (auth, pipeline, batch, settings, teams, roles, audit, api-keys, files, docs)
- Lib coverage improvements (audit 7%->95%, worker-pool 33%->100%)
- Web store/lib gap fills (features-store, tool-registry)

Integration tests (4,403 total, +903):
- Expanded 19 tool test files with parameter variations, format edge cases, boundary values
- Cross-format matrix: 290 tests covering 14 tools x 17 formats
- Adversarial/edge cases: 63 tests for extreme inputs, concurrent requests, corrupted files

E2E-Docker (125 new tests):
- Expanded 8 spec files + 1 new file covering all 49 tools
- Added HEIC/format handling, auth failures, download verification

GUI E2E (expanded 28 spec files):
- Navigation, responsive layout, keyboard shortcuts
- All 51 tool UIs with settings, processing, display modes
- Batch/pipeline workflows, settings/RBAC, visual regression
- Resilience, accessibility (ARIA, contrast, focus), performance budgets

tests/unit/web/analytics-no-leak.test.ts

@@ -2,7 +2,7 @@
 //
 // Proves the invariant: PostHog and Sentry are NEVER called when
 // analytics is disabled or the user has not granted consent.
-import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
+import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
 
 const mockPosthogInit = vi.fn(() => ({
   capture: mockCapture,
@@ -197,7 +197,7 @@ describe("Analytics No-Leak Invariant", () => {
       await initAnalytics(enabledConfig);
       const sentryCall = mockSentryInit.mock.calls.find((call: unknown[]) => call[0]?.beforeSend);
       expect(sentryCall).toBeDefined();
-      const beforeSend = sentryCall![0].beforeSend;
+      const beforeSend = sentryCall?.[0].beforeSend;
 
       setAnalyticsConsent(false);
       const result = beforeSend({ exception: { values: [] } });
@@ -211,7 +211,7 @@ describe("Analytics No-Leak Invariant", () => {
         (call: unknown[]) => call[0]?.beforeBreadcrumb,
       );
       expect(sentryCall).toBeDefined();
-      const beforeBreadcrumb = sentryCall![0].beforeBreadcrumb;
+      const beforeBreadcrumb = sentryCall?.[0].beforeBreadcrumb;
 
       setAnalyticsConsent(false);
       const result = beforeBreadcrumb({ category: "console", message: "test" });
@@ -285,7 +285,7 @@ describe("Analytics No-Leak Invariant", () => {
       setAnalyticsConsent(true);
       await initAnalytics(enabledConfig);
       const sentryCall = mockSentryInit.mock.calls.find((call: unknown[]) => call[0]?.beforeSend);
-      const beforeSend = sentryCall![0].beforeSend;
+      const beforeSend = sentryCall?.[0].beforeSend;
 
       const event = {
         user: { email: "user@example.com", username: "admin", id: "123" },
@@ -301,7 +301,7 @@ describe("Analytics No-Leak Invariant", () => {
       setAnalyticsConsent(true);
       await initAnalytics(enabledConfig);
       const sentryCall = mockSentryInit.mock.calls.find((call: unknown[]) => call[0]?.beforeSend);
-      const beforeSend = sentryCall![0].beforeSend;
+      const beforeSend = sentryCall?.[0].beforeSend;
 
       const event = {
         exception: {
@@ -327,7 +327,7 @@ describe("Analytics No-Leak Invariant", () => {
       const sentryCall = mockSentryInit.mock.calls.find(
         (call: unknown[]) => call[0]?.beforeBreadcrumb,
       );
-      const beforeBreadcrumb = sentryCall![0].beforeBreadcrumb;
+      const beforeBreadcrumb = sentryCall?.[0].beforeBreadcrumb;
 
       expect(beforeBreadcrumb({ category: "ui.click" })).toBeNull();
     });
@@ -338,7 +338,7 @@ describe("Analytics No-Leak Invariant", () => {
       const sentryCall = mockSentryInit.mock.calls.find(
         (call: unknown[]) => call[0]?.beforeBreadcrumb,
       );
-      const beforeBreadcrumb = sentryCall![0].beforeBreadcrumb;
+      const beforeBreadcrumb = sentryCall?.[0].beforeBreadcrumb;
 
       expect(
         beforeBreadcrumb({