fix: close SVG sanitization gap on upload routes and fix OCR/extension bugs

Security:
- Apply sanitizeSvg() to all file upload routes (files.ts, user-files.ts)
  preventing SSRF and script injection via SVG uploads to file library

Functional:
- Handle PaddleOCR-VL 1.5 markdown_texts output format in ocr.py
- Add empty-text fallback in OCR tier chain (ocr.ts) so higher tiers
  that return empty text fall back to the next tier automatically
- Fix SVG->PNG filename extension mismatch in tool-factory.ts so
  download endpoint serves correct Content-Type
- Report original upload size (not decoded size) in API response

Test infrastructure:
- Move Playwright auth state from test-results/ to .playwright/ to
  prevent mid-run cleanup deleting auth files
- Fix auth.setup.ts navigation race with waitForURL
- Fix gui-batch.spec.ts regex matching "Presets" instead of "reset"
- Fix pipeline-advanced.spec.ts crop bounds and resize assertions
- Broaden pipeline cleanup to include all E2E-prefixed pipelines

apps/api/src/routes/tools/ocr.ts

@@ -142,6 +142,17 @@ export function registerOcr(app: FastifyInstance) {
             onProgress,
           );
 
+          // If a higher-quality tier returns empty text but didn't crash,
+          // fall back to the next tier rather than returning nothing.
+          if (!result.text && tier !== fallbackChain[fallbackChain.length - 1]) {
+            request.log.warn(
+              { toolId: "ocr", quality: tier, engine: result.engine },
+              `OCR ${tier} returned empty text, falling back to next tier`,
+            );
+            if (onProgress) onProgress(15, "Retrying...");
+            continue;
+          }
+
           if (clientJobId) {
             updateSingleFileProgress({
               jobId: clientJobId,