fix(e2e,landing): robust path escaping (CodeQL) + unique file-tools card

- tests/e2e/helpers.ts: build the sharp script path via JSON.stringify
  instead of single-quote-only replace (CodeQL js/incomplete-sanitization,
  high: backslashes were not escaped). Proper fix, no suppression.
- landing CategoryCards: rename the file-modality marketing card to
  "File Tools" (matches the Image/Video/Audio Tools siblings and is
  unique vs the 23 "Files" tool pills, which broke the e2e locator).
  Modality label stays "Files" everywhere it is the actual modality.

apps/landing/src/components/CategoryCards.astro

@@ -51,7 +51,7 @@ const MODALITIES = [
   {
     id: "file",
     section: "files",
-    label: "Files",
+    label: "File Tools",
     blurb: "Convert and transform",
     icon: "Database",
     color: "#5C8642",

tests/e2e-landing/homepage.spec.ts

@@ -40,7 +40,7 @@ test.describe("Landing Homepage", () => {
   });
 
   test("hero modality cards render", async ({ page }) => {
-    const cards = ["Image Tools", "Video Tools", "Audio Tools", "PDF & Documents", "Files"];
+    const cards = ["Image Tools", "Video Tools", "Audio Tools", "PDF & Documents", "File Tools"];
     for (const card of cards) {
       await expect(page.getByText(card, { exact: true }).first()).toBeVisible();
     }

tests/e2e/helpers.ts

@@ -34,7 +34,7 @@ export function getTestImagePath(): string {
   try {
     const script = [
       "const sharp = require('sharp');",
-      `sharp({create:{width:100,height:100,channels:4,background:{r:255,g:0,b:0,alpha:1}}}).png().toFile('${_testImagePath.replace(/'/g, "\\'")}')`,
+      `sharp({create:{width:100,height:100,channels:4,background:{r:255,g:0,b:0,alpha:1}}}).png().toFile(${JSON.stringify(_testImagePath)})`,
     ].join(" ");
     execFileSync("node", ["-e", script], {
       cwd: process.cwd(),