fix: resolve CI test failures for exotic formats and fetch-urls

Install ImageMagick, Ghostscript, libjxl-tools, and libopenjp2-tools in
CI so exotic format decoder tests (PSD, EPS, HDR, ICO, JP2, etc.) can
run. Relax ImageMagick EPS/PS security policy to match the Dockerfile.

Replace fragile vi.mock() of the SSRF module in fetch-urls tests with an
env-var guard (SSRF_ALLOW_PRIVATE) that bypasses private-IP checks in
the test environment. The vi.mock approach broke under V8 coverage
instrumentation in CI.

apps/api/src/lib/ssrf.ts

@@ -33,6 +33,10 @@ function isPrivateIPv6(ip: string): boolean {
 }
 
 async function resolveAndCheck(hostname: string): Promise<void> {
+  // Allow tests to bypass private-IP checks so a local mock HTTP server can be
+  // used without fragile vi.mock() overrides that break under V8 coverage.
+  if (process.env.SSRF_ALLOW_PRIVATE === "1") return;
+
   const bare = hostname.replace(/^\[|]$/g, "");
   if (isIP(bare)) {
     if (isPrivateIPv4(bare) || isPrivateIPv6(bare)) {