fix: close SVG sanitization gap on upload routes and fix OCR/extension bugs

Security:
- Apply sanitizeSvg() to all file upload routes (files.ts, user-files.ts)
  preventing SSRF and script injection via SVG uploads to file library

Functional:
- Handle PaddleOCR-VL 1.5 markdown_texts output format in ocr.py
- Add empty-text fallback in OCR tier chain (ocr.ts) so higher tiers
  that return empty text fall back to the next tier automatically
- Fix SVG->PNG filename extension mismatch in tool-factory.ts so
  download endpoint serves correct Content-Type
- Report original upload size (not decoded size) in API response

Test infrastructure:
- Move Playwright auth state from test-results/ to .playwright/ to
  prevent mid-run cleanup deleting auth files
- Fix auth.setup.ts navigation race with waitForURL
- Fix gui-batch.spec.ts regex matching "Presets" instead of "reset"
- Fix pipeline-advanced.spec.ts crop bounds and resize assertions
- Broaden pipeline cleanup to include all E2E-prefixed pipelines

packages/ai/python/ocr.py

@@ -185,6 +185,12 @@ def run_paddleocr_vl(input_path):
 
         text_parts = []
         for res in output:
+            # PaddleOCR-VL 1.5+: markdown_texts holds the extracted text
+            if hasattr(res, "markdown") and isinstance(res.markdown, dict):
+                md_text = res.markdown.get("markdown_texts", "")
+                if md_text:
+                    text_parts.append(md_text)
+                    continue
             if hasattr(res, "parsing_res_list"):
                 for block in res.parsing_res_list:
                     content = block.get("block_content", "")