fix: close SVG sanitization gap on upload routes and fix OCR/extension bugs

Security:
- Apply sanitizeSvg() to all file upload routes (files.ts, user-files.ts)
  preventing SSRF and script injection via SVG uploads to file library

Functional:
- Handle PaddleOCR-VL 1.5 markdown_texts output format in ocr.py
- Add empty-text fallback in OCR tier chain (ocr.ts) so higher tiers
  that return empty text fall back to the next tier automatically
- Fix SVG->PNG filename extension mismatch in tool-factory.ts so
  download endpoint serves correct Content-Type
- Report original upload size (not decoded size) in API response

Test infrastructure:
- Move Playwright auth state from test-results/ to .playwright/ to
  prevent mid-run cleanup deleting auth files
- Fix auth.setup.ts navigation race with waitForURL
- Fix gui-batch.spec.ts regex matching "Presets" instead of "reset"
- Fix pipeline-advanced.spec.ts crop bounds and resize assertions
- Broaden pipeline cleanup to include all E2E-prefixed pipelines

tests/e2e/gui-pipeline.spec.ts

@@ -273,8 +273,8 @@ test.describe("Pipeline Builder - Save/Load", () => {
         headers: { Authorization: `Bearer ${token}` },
       });
       const { pipelines } = await listRes.json();
-      for (const p of pipelines.filter((p: { name: string }) =>
-        p.name.startsWith("GUI E2E Pipeline"),
+      for (const p of pipelines.filter(
+        (p: { name: string }) => p.name.startsWith("GUI E2E Pipeline") || p.name.startsWith("E2E "),
       )) {
         await fetch(`${apiUrl}/api/v1/pipeline/${p.id}`, {
           method: "DELETE",