fix: resolve 18 QA-discovered bugs across tools, previews, and the AI pipeline (#242)

Exhaustive QA sweep of all 157 tools. Fixes: CSP blob media, csv-excel ExcelJS interop, ocr-pdf segfault, chart-maker upload, non-PDF doc preview, RAW decode, merge-tool multi-file path, html-to-image chromium, ogv/wma/amr/ac3 preview fallbacks, meme/gif/stabilize codecs, nav+home a11y. Plus orphan-format and test-debt cleanup, the AI bundle build script, and a reusable Playwright QA harness under tests/qa/.

apps/api/src/lib/file-validation.ts

@@ -243,6 +243,13 @@ export async function validateImageBuffer(
     detectedFormat = "png";
   }
 
+  // RAW formats with non-TIFF magic bytes (Panasonic RW2, some Olympus ORF,
+  // Pentax PEF, etc.) are not caught by MAGIC_BYTES.  Fall back to
+  // extension-based detection for known Camera RAW extensions.
+  if (!detectedFormat && ext && isRawExtension(ext)) {
+    detectedFormat = "raw";
+  }
+
   if (!detectedFormat) {
     return { valid: false, reason: "Unrecognized image format" };
   }