test(formats): open one of every file type the handlers claim

[skjnldsv]

The handlers claim about thirty-five mime types. Six were ever opened by a test, and audio had none at all: audio.mp3 sat in the playground and no spec touched it.

The svg one is the reason I started. It is the only image the viewer does not hand straight to the element: it gets fetched, run through DOMPurify and handed over as a data URL, and that path exists for XSS. Nothing covered it, so a refactor that dropped the sanitiser would have gone unnoticed. The fixture carries a <script>, an onload and a foreignObject with an onerror, and the test decodes the data URL back out of the element to check they are gone while the circle and the title survive.

One thing I want to flag rather than bury, because it changed what I shipped. I first wrote a second test asserting none of that script ran. It passed. Then I removed the sanitiser to check the tests were worth having, and it still passed, because the viewer shows an svg through an <img> and no browser runs script in one of those whatever it contains. It was asserting a browser rule, not our code. I deleted it and left a note in the spec saying so. The remaining assertions do fail with the sanitiser removed.

The rest is breadth, one fixture each: png, bmp, webp, x-icon and a real two-frame apng next to the avif, each checked by the decoded size rather than by the element existing. Audio covers everything both engines decode, including all three names a WAV can arrive under, which is what #45 fixed and never had a test.

audio/aacp is claimed and deliberately not covered: Chromium answers no to it, so a fixture would only record which engine happened to run. Same reasoning would apply to a few video codecs.

Still untested after this, and not coverable here: image/heic, image/heif, image/tiff, image/emf, image/x-xbitmap and image/jp2. All six depend on the server rendering a preview, so they need the real-server suite we talked about rather than the playground.

Navigation listed the fixtures by hand and now lists more of them.

354 unit, 80 e2e across both engines.

👾 This pull request was assisted by Claude Code, commits carry an Assisted-by trailer.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.62%. Comparing base (345aaa1) to head (b2f155a).

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #55   +/-   ##
=======================================
  Coverage   88.62%   88.62%           
=======================================
  Files          39       39           
  Lines        2743     2743           
  Branches      561      561           
=======================================
  Hits         2431     2431           
  Misses        305      305           
  Partials        7        7           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.