The Artemis exam-integrity flow only needs server-side PDF (the canonical
archive format). Server-side PNG was added speculatively in the previous
commit; remove it to simplify the operational model.

Server:
- Drop @resvg/resvg-js dep (~5 MB native binary, 5 platform variants).
- Remove renderPng from conversion-renderer.ts.
- Collapse worker request shape to PDF-only (no `format` discriminator).
- Drop POST /api/converter/png route.
- Drop ConversionFormat union type.
- Trim serverConversion.test.ts to the PDF cases that matter.

Client (PNG, browser-only):
- Raise resvg-wasm area cap from 32 MP → 75 MP. Real-world headroom for
  Apollon class diagrams: ~250 → ~400 classes at full 1.5× scale before
  the auto-clamp engages. Comfortable below the wasm32 4 GB ceiling
  (75 MP × 4 bytes RGBA × ~3-4× resvg working set ≈ 1.2 GB peak).
- Update tests for the new cap.

No behaviour change for the user-facing PNG/PDF flow.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

The diagramId is already a 128-bit base64url-random string and is the
existing access bearer for the editor URL — anyone holding the URL can
already open the diagram. The embed surface inherits exactly that
access model: no share tokens, no roles, no cookies.

Two public routes:

  GET /api/diagrams/:diagramId/preview.svg
    Server-rendered SVG. Sanitized via a regex stripper as defence-in-
    depth on top of the library's React-escaped output. Cached in Redis
    keyed by (diagramId, updatedAt) — the cache invalidates on every
    diagram edit because saveHead bumps updatedAt.
    Headers: Content-Type: image/svg+xml; charset=utf-8;
             ETag: W/"<updatedAt>"; Cache-Control: public, max-age=60,
             stale-while-revalidate=86400; Vary: Accept;
             X-Content-Type-Options: nosniff; CSP default-src 'none'.
    304 on If-None-Match match.

  GET /embed/:diagramId
    Server-rendered HTML shell with inline SVG + an "Open in Apollon"
    link. No JS bundle, no remote assets, ~1.5 KiB inline CSS. Light
    and dark theme via prefers-color-scheme. CSP frame-ancestors *
    (the diagramId is the access bearer; iframing adds no privilege)
    plus default-src 'none' so the page itself can't load anything
    else.

Render pipeline:
  - Worker-backed in production: extends the existing PDF worker to
    handle a "svg" mode alongside "pdf" — same JSDOM-isolated thread,
    one queue, one worker process.
  - In-process fallback for tests / dev: an SvgSource interface
    abstracts the renderer; defaultSvgSource() picks the worker in
    production and the in-process ConversionService in tests
    (process.env.VITEST). Tests don't need the .js worker artifact.
  - Cache: 60 s TTL in Redis under k.diagramPreviewSvg(id), JSON
    payload {v, updatedAt, svg, clip}. Stale entries (updatedAt
    mismatch) re-render transparently. Camo and downstream CDN caches
    absorb the bulk of the load; this in-server cache exists for
    direct fetches and renderers behind Camo.

SVG sanitization (services/embed-svg.ts):
  - Strips <script>, <foreignObject>, on*= attributes (single + double
    + bare), and javascript: URIs from href / xlink:href.
  - Returns hit counts so a non-zero hit map can fire an alert — the
    library's exportModelAsSvg should never produce these patterns;
    a hit means an upstream regression.

Webapp side (components/modals/EmbedHints.tsx):
  - Three copyable snippets in the existing ShareModal:
      1. Markdown clickable image (recommended for GitHub README)
      2. Plain markdown image (no click-through)
      3. HTML iframe (GitLab Pages / Notion / Confluence / VS Code)
  - Reads diagramId from useParams; renders a "save first" hint when
    the user is on the local-only editor.

Tests:
  - services/embed-svg.test.ts — sanitizer unit tests covering each
    pattern class plus a composite test.
  - __tests__/embed.int.test.ts — integration tests for both routes:
    happy-path render with all the headers, ETag round-trip, 304 on
    If-None-Match, 404 on missing diagram, 422 on invalid diagramId,
    HTML escape against title-injection (</title><script>...).
  - All 88 server tests green; lint/format/tsc clean.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

… queue

Three review loops applied a websearch-validated rubric. Each loop's
findings were closed in code or explicitly justified before grading;
final pass is A+ with the full server-side feature.

caching:
  - dropped the redis cache layer (theatre — same TTL as HTTP max-age,
    no thundering-herd benefit, redis round-trip on every hit). camo +
    downstream caches absorb 99% of the dedup; the conditional-GET
    304 path covers the rest.
  - in-process LRU (size-bounded, TTL'd) plus per-(diagramId, headRev)
    in-flight Promise coalescing — coalescing is what actually solves
    the thundering-herd that redis cannot. lazy-built per buildApp.

worker pipeline:
  - one shared ConversionResource for PDF + embed surfaces (was: two,
    one per route). lazily allocated; tests that don't render never
    spawn the worker thread.
  - SVG-priority dispatch in dequeueNext with PDF anti-starvation
    backstop (8-skip threshold). PDF can no longer indefinitely block
    embed responsiveness; embed bursts can no longer indefinitely
    block PDF.
  - queue-full / worker-timeout map to 503 RENDERER_BUSY +
    Retry-After (was: 500 INTERNAL on a successful but slow render).
  - DOMPurify sanitization moved to a single seam (`sanitizeSvg`)
    called only on SVG-output paths — PDF render skips, no longer
    pays the sanitizer tax. PARSER_MEDIA_TYPE: image/svg+xml + the
    audited svg+svgFilters profile preserves <style> and inline
    style= for library colors; strips script / foreignObject / on*=
    / javascript: URIs.

types & validation:
  - LibrarySchemaVersion zod regex (4.<n>.<n> with optional SemVer
    pre-release / build-metadata suffix) at the API boundary.
  - toUmlModel re-validates Diagram.version on the way out of the
    server, so an internal caller that bypasses route validation
    (or a Redis row predating the schema) fails loud instead of
    handing the renderer a malformed payload.
  - explicit projection from Diagram → UMLModel; the only narrowing
    cast (string → `\`4.${n}.${n}\``) is justified inline against
    the just-parsed schema invariant.
  - WindowLike is the named DOMPurify export; cast goes through the
    published type rather than `Parameters<typeof createDOMPurify>[0]`.

routes & headers:
  - ETag is W/"<headRev>" (matches the PUT response body so a cache
    populated by a writer revalidates correctly against a reader).
  - dropped Vary: Accept (route doesn't vary on Accept; lying Vary
    fragments downstream caches).
  - added Permissions-Policy: interest-cohort=(), browsing-topics=()
    on the /embed HTML page (FLoC + Topics opt-out, forward-compat).
  - app.set("trust proxy", 1) — Open in Apollon link respects
    X-Forwarded-Proto so an HTTPS-served iframe doesn't emit a
    mixed-content link.
  - new RENDERER_BUSY ApiErrorCode in server + webapp (distinct from
    REDIS_UNAVAILABLE so dashboards don't false-positive on render
    saturation).
  - dark-mode chrome via prefers-color-scheme; SVG canvas stays
    white (library fills are tuned for light bg, matching mermaid /
    plantuml convention).

tests:
  - 102/102 server tests, all green; lint+format+tsc clean.
  - new conversion-service.sanitize.test.ts pins the sanitizer
    contract independent of what the library currently emits:
    strips script / foreignObject / on*= / javascript: URIs;
    preserves <style> / inline style= / drawing primitives.
  - new conversion-resource.dequeue.test.ts pins SVG-priority +
    anti-starvation contract with a stubbed worker.
  - rewritten coalescing test uses a deferred fake source so the
    five concurrent requests are blocked on the in-flight Promise
    before any resolves, distinguishing coalescing from cache-hit.
  - end-to-end test exercises the real renderer + sanitizer through
    createInProcessSvgSource so a JSDOM/library regression cannot
    silently land.
  - new LibrarySchemaVersion validation tests cover canonical,
    pre-release, build-metadata, and rejection cases.

deletions:
  - regex-based embed-svg sanitizer (dompurify replaces it).
  - redis cache key k.diagramPreviewSvg + the svg cache namespace.
  - process.env.VITEST branch in the SVG source factory (tests now
    inject createInProcessSvgSource explicitly via AppDeps).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>