fix: resolve 18 QA-discovered bugs across tools, previews, and the AI pipeline (#242)

Exhaustive QA sweep of all 157 tools. Fixes: CSP blob media, csv-excel ExcelJS interop, ocr-pdf segfault, chart-maker upload, non-PDF doc preview, RAW decode, merge-tool multi-file path, html-to-image chromium, ogv/wma/amr/ac3 preview fallbacks, meme/gif/stabilize codecs, nav+home a11y. Plus orphan-format and test-debt cleanup, the AI bundle build script, and a reusable Playwright QA harness under tests/qa/.

tests/qa/extract-tools-meta.mts

@@ -0,0 +1,28 @@
+// Extracts tool metadata from @snapotter/shared into tools-meta.json so the QA
+// harness and discovery shards have routing (/:modality/:toolId), the input-format
+// matrix, execution hints, and AI flags without resolving the workspace package at
+// Playwright runtime. Run: npx tsx tests/qa/extract-tools-meta.mts
+import { writeFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { PYTHON_SIDECAR_TOOLS, TOOLS } from "../../packages/shared/src/constants.js";
+
+const ai = new Set<string>(PYTHON_SIDECAR_TOOLS as readonly string[]);
+
+const meta = TOOLS.map((t) => ({
+  id: t.id,
+  name: t.name,
+  modality: t.modality,
+  acceptedInputs: t.acceptedInputs,
+  executionHint: t.executionHint,
+  isAI: ai.has(t.id),
+}));
+
+const outPath = path.join(path.dirname(fileURLToPath(import.meta.url)), "tools-meta.json");
+writeFileSync(outPath, `${JSON.stringify(meta, null, 2)}\n`);
+
+const byModality: Record<string, number> = {};
+for (const m of meta) byModality[m.modality] = (byModality[m.modality] ?? 0) + 1;
+console.log(`wrote ${meta.length} tools to ${outPath}`);
+console.log("by modality:", JSON.stringify(byModality));
+console.log("AI tools:", meta.filter((m) => m.isAI).length);