feat: multi-arch Docker support, security hardening, and test improvements

Remove hardcoded --platform=linux/amd64 from Dockerfile so buildx produces
native arm64 images for Apple Silicon and Raspberry Pi. Add audit logging
for auth events, harden file storage with extension whitelists and
double-extension attack prevention, reject null-byte buffers in validation,
add data-testid attributes to all tool settings components, update
deployment docs with architecture notes and correct CI workflow references,
and fix unit test mock to match throwWithMessage error extraction.

apps/api/src/lib/file-storage.ts

@@ -3,6 +3,20 @@ import { mkdir, unlink, writeFile } from "node:fs/promises";
 import { extname, join } from "node:path";
 import { env } from "../config.js";
 
+const SAFE_STORAGE_EXTENSIONS = new Set([
+  ".jpg",
+  ".jpeg",
+  ".png",
+  ".webp",
+  ".gif",
+  ".bmp",
+  ".tiff",
+  ".tif",
+  ".avif",
+  ".svg",
+  ".pdf",
+]);
+
 let storageReady = false;
 
 export async function ensureStorageDir(): Promise<void> {
@@ -13,7 +27,12 @@ export async function ensureStorageDir(): Promise<void> {
 
 export async function saveFile(buffer: Buffer, originalName: string): Promise<string> {
   await ensureStorageDir();
-  const ext = extname(originalName).toLowerCase() || ".bin";
+  let ext = extname(originalName).toLowerCase() || ".bin";
+  // Only allow known image extensions to be stored — reject dangerous extensions
+  // even if they somehow pass upstream sanitization.
+  if (!SAFE_STORAGE_EXTENSIONS.has(ext)) {
+    ext = ".bin";
+  }
   const storedName = `${randomUUID()}${ext}`;
   await writeFile(join(env.FILES_STORAGE_PATH, storedName), buffer);
   return storedName;