chore: remove dead code, add test infrastructure, update docs

- Delete 3 dead files: use-batch-processor.ts, use-i18n.ts, smart-crop.ts (AI package)
- Remove dead getJobProgress function and unused runPythonScript wrapper
- Remove 6 unused imports across API and web apps
- Remove unused shared types (ImageFormat, AppConfig, ApiError, HealthResponse, JobProgress)
  and constants (SUPPORTED_INPUT_FORMATS/OUTPUT_FORMATS, DEFAULT_OUTPUT_FORMAT)
- Remove unused store method (setOriginalBlobUrl) and clean AI package re-exports
- Add test infrastructure: vitest config, unit/integration/e2e tests, fixtures, screenshots
- Add Docker test infrastructure: Dockerfile.test, docker-compose.test.yml
- Add download_models.py for pre-baking AI model weights in Docker
- Add filename sanitization utility (apps/api/src/lib/filename.ts)
- Update .gitignore to exclude coverage/, *.tsbuildinfo, .superpowers/, test artifacts
- Update .dockerignore to exclude test/coverage/IDE artifacts from builds
- Update docs: remove smart crop from AI docs (uses Sharp directly), update bridge docs

apps/api/src/routes/tools/svg-to-raster.ts

@@ -13,6 +13,25 @@ const settingsSchema = z.object({
   outputFormat: z.enum(["png", "jpg", "webp"]).default("png"),
 });
 
+const MAX_SVG_SIZE = 10 * 1024 * 1024; // 10MB
+
+function sanitizeSvg(buffer: Buffer): Buffer {
+  if (buffer.length > MAX_SVG_SIZE) {
+    throw new Error(`SVG exceeds maximum size of ${MAX_SVG_SIZE / 1024 / 1024}MB`);
+  }
+  let svg = buffer.toString("utf-8");
+  // Remove DOCTYPE to prevent XXE
+  svg = svg.replace(/<!DOCTYPE[^>]*>/gi, "");
+  // Remove script tags
+  svg = svg.replace(/<script[\s\S]*?<\/script>/gi, "");
+  // Remove event handlers (onload, onclick, etc.)
+  svg = svg.replace(/\bon\w+\s*=/gi, "data-removed=");
+  // Remove external resource references
+  svg = svg.replace(/xlink:href\s*=\s*["']https?:\/\//gi, 'xlink:href="data:,');
+  svg = svg.replace(/href\s*=\s*["']https?:\/\//gi, 'href="data:,');
+  return Buffer.from(svg, "utf-8");
+}
+
 /**
  * SVG to raster conversion.
  * Custom route since input is SVG (not validated as image by magic bytes).
@@ -50,6 +69,15 @@ export function registerSvgToRaster(app: FastifyInstance) {
         return reply.status(400).send({ error: "No SVG file provided" });
       }
 
+      // Sanitize SVG to prevent XXE, SSRF, and script injection
+      try {
+        fileBuffer = sanitizeSvg(fileBuffer);
+      } catch (err) {
+        return reply.status(400).send({
+          error: err instanceof Error ? err.message : "Invalid SVG",
+        });
+      }
+
       let settings: z.infer<typeof settingsSchema>;
       try {
         const parsed = settingsRaw ? JSON.parse(settingsRaw) : {};