fix: resolve 18 QA-discovered bugs across tools, previews, and the AI pipeline (#242)

Exhaustive QA sweep of all 157 tools. Fixes: CSP blob media, csv-excel ExcelJS interop, ocr-pdf segfault, chart-maker upload, non-PDF doc preview, RAW decode, merge-tool multi-file path, html-to-image chromium, ogv/wma/amr/ac3 preview fallbacks, meme/gif/stabilize codecs, nav+home a11y. Plus orphan-format and test-debt cleanup, the AI bundle build script, and a reusable Playwright QA harness under tests/qa/.

docker/Dockerfile

@@ -200,7 +200,7 @@ RUN for i in 1 2 3; do apt-get -o Acquire::Retries=3 update && break || sleep $(
     tini \
     imagemagick \
     libjxl-tools \
-    libraw-dev \
+    libraw-dev libraw-bin \
     libopenexr-dev \
     potrace \
     ghostscript \
@@ -309,9 +309,16 @@ RUN --mount=type=cache,id=pnpm-store,target=/root/.local/share/pnpm/store/v3 \
     npm pkg delete scripts.prepare && \
     pnpm install --frozen-lockfile --prod
 
-# Install Playwright Chromium for HTML-to-Image tool
-RUN npx playwright install chromium --with-deps && \
-    rm -rf /tmp/* /root/.cache/ms-playwright/.links
+# Install Playwright Chromium for HTML-to-Image tool.
+# PLAYWRIGHT_BROWSERS_PATH puts browsers in a shared location so the
+# non-root snapotter user can find and execute them at runtime.
+# Use the workspace's pinned Playwright (not `npx playwright`, which fetches a
+# NEWER version and installs a chromium build the runtime playwright cannot
+# resolve) so the installed browser matches chromium.executablePath().
+ENV PLAYWRIGHT_BROWSERS_PATH=/opt/playwright-browsers
+RUN pnpm --filter @snapotter/api exec playwright install chromium --with-deps && \
+    chmod -R a+rX /opt/playwright-browsers && \
+    rm -rf /tmp/*
 
 # Copy source code for API (tsx runs TS directly - no build step needed)
 COPY apps/api/src ./apps/api/src