chore: remove dead code, add test infrastructure, update docs

- Delete 3 dead files: use-batch-processor.ts, use-i18n.ts, smart-crop.ts (AI package)
- Remove dead getJobProgress function and unused runPythonScript wrapper
- Remove 6 unused imports across API and web apps
- Remove unused shared types (ImageFormat, AppConfig, ApiError, HealthResponse, JobProgress)
  and constants (SUPPORTED_INPUT_FORMATS/OUTPUT_FORMATS, DEFAULT_OUTPUT_FORMAT)
- Remove unused store method (setOriginalBlobUrl) and clean AI package re-exports
- Add test infrastructure: vitest config, unit/integration/e2e tests, fixtures, screenshots
- Add Docker test infrastructure: Dockerfile.test, docker-compose.test.yml
- Add download_models.py for pre-baking AI model weights in Docker
- Add filename sanitization utility (apps/api/src/lib/filename.ts)
- Update .gitignore to exclude coverage/, *.tsbuildinfo, .superpowers/, test artifacts
- Update .dockerignore to exclude test/coverage/IDE artifacts from builds
- Update docs: remove smart crop from AI docs (uses Sharp directly), update bridge docs

apps/api/src/routes/pipeline.ts

@@ -8,13 +8,14 @@
  */
 import { randomUUID } from "node:crypto";
 import { writeFile } from "node:fs/promises";
-import { join, basename } from "node:path";
+import { join } from "node:path";
 import type { FastifyInstance, FastifyRequest, FastifyReply } from "fastify";
 import { eq } from "drizzle-orm";
 import { z } from "zod";
 import { getToolConfig } from "./tool-factory.js";
 import { validateImageBuffer } from "../lib/file-validation.js";
 import { createWorkspace } from "../lib/workspace.js";
+import { sanitizeFilename } from "../lib/filename.js";
 import { db, schema } from "../db/index.js";
 
 /** Schema for a single pipeline step. */
@@ -25,29 +26,16 @@ const pipelineStepSchema = z.object({
 
 /** Schema for a full pipeline definition. */
 const pipelineDefinitionSchema = z.object({
-  steps: z.array(pipelineStepSchema).min(1, "Pipeline must have at least one step"),
+  steps: z.array(pipelineStepSchema).min(1, "Pipeline must have at least one step").max(20, "Pipeline cannot exceed 20 steps"),
 });
 
 /** Schema for saving a pipeline. */
 const savePipelineSchema = z.object({
   name: z.string().min(1, "Pipeline name is required").max(100),
   description: z.string().max(500).optional(),
-  steps: z.array(pipelineStepSchema).min(1, "Pipeline must have at least one step"),
+  steps: z.array(pipelineStepSchema).min(1, "Pipeline must have at least one step").max(20, "Pipeline cannot exceed 20 steps"),
 });
 
-/**
- * Sanitize a filename to prevent path traversal attacks.
- */
-function sanitizeFilename(raw: string): string {
-  let name = basename(raw);
-  name = name.replace(/\.\./g, "");
-  name = name.replace(/\0/g, "");
-  if (!name || name === "." || name === "..") {
-    name = "image";
-  }
-  return name;
-}
-
 export async function registerPipelineRoutes(app: FastifyInstance): Promise<void> {
   /**
    * POST /api/v1/pipeline/execute