fix(security,reliability): address code-review findings

HIGH
- async handlers: Express 4 does not catch rejected promises and Node 22
  exits on unhandled rejections — a malformed body ({} to /cropper/dequeue
  etc.) could hang a request or kill the process. Every cropper route is
  now wrapped (throw → 500 via next), request bodies are validated up
  front (400), and JSON.parse of queue items is guarded. Server-wide
  error middleware added, honouring err.status (413 for oversized bodies).
- error pages HTML-escape all interpolated values — the login failure page
  rendered upstream (portal) error text raw.

MEDIUM
- outbound calls carry AbortSignal timeouts (5s OpenFGA verify, 15s
  cropper upstreams) — a hung upstream can no longer pin a request.
- body limits scoped: /cropper gets 50mb (picture data URLs), everything
  else 1mb (previously 50mb globally, memory-DoS surface pre-auth).
- cropper save validates the client-supplied domain against the catalog;
  picture fetches validate the Minio object key (id-domains/ prefix, no ..).

LOW
- static assets served before the session middleware (no PocketBase load
  per asset); landing header builds DOM nodes with textContent instead of
  innerHTML; picture load checks upstream ok.

5 new tests (40 total) covering malformed bodies, malformed queue items,
unknown domains, object-key traversal, and error-page escaping.

tools/public/index.html

@@ -76,11 +76,21 @@
       .then(function (session) {
         var host = document.getElementById('nav-session');
         if (!session) return; // keep the Sign in link
-        var first = (session.firstName || session.phone || '?').trim();
-        host.innerHTML =
-          '<span class="user-chip"><span class="avatar">' + first.slice(0, 2).toUpperCase() + '</span>' +
-          (session.firstName || session.phone) + '</span>' +
-          '<a class="linklike" href="/auth/logout">Sign out</a>';
+        var name = (session.firstName || session.phone || '?').trim();
+        host.textContent = '';
+        var chip = document.createElement('span');
+        chip.className = 'user-chip';
+        var avatar = document.createElement('span');
+        avatar.className = 'avatar';
+        avatar.textContent = name.slice(0, 2).toUpperCase(); // textContent, never innerHTML
+        var label = document.createElement('span');
+        label.textContent = name;
+        chip.append(avatar, label);
+        var signOut = document.createElement('a');
+        signOut.className = 'linklike';
+        signOut.href = '/auth/logout';
+        signOut.textContent = 'Sign out';
+        host.append(chip, signOut);
       })
       .catch(function () { /* keep Sign in */ });
   </script>