feat(translation): quality pipeline overhaul + new features (audit 2026-08-29)

Translation quality & format preservation:
- Word: merge adjacent same-format runs into one unit (sentence-level
  coherence like inline-tag handling); translate comments/balloons;
  dedupe textbox collection (was translated twice); RTL no longer
  overrides center/justify alignment; CJK/Arabic font hints (eastAsia/cs)
- PPTX: chart translations now actually reach the output file
  (ChartPart.blob is read-only — rewrite chart XML in the saved ZIP);
  CJK typeface hints (a:ea)
- Excel: sheet renames no longer break references — rewrite cell
  formulas (3D/quoted), defined names, data validations, cond. formats
- PDF: bold/italic honored (hebo/heit/hebi); table cells never merge;
  unchanged blocks left untouched (typography preserved, fixes duplicate
  hyperlinks); attempted/changed stats + route gate now cover PDF;
  CJK font paths; scanned PDFs via Mistral OCR (detection + admin settings)

Features:
- formality param (formal/informal) + automatic regional-variant prompts
- output_mode=bilingual docx (source above translation)
- per-user translation memory on Redis (falls back to LRU), context-hashed
- QA report + 0-100 confidence score in job status; L0 on by default
- OpenAI-compatible providers: whole chunk in ONE numbered-JSON request
  (~15x fewer calls) with per-item fallback; base prompt always present
  (custom prompt no longer replaces translation instructions)

Infra & marketing alignment:
- plan-based engine gating + vision gating (closes paid-engine leak);
  /providers/available filtered per plan; 107 languages exposed
- zh-CN/zh-TW validation fixed; libmagic disabled on Windows (native crash)
- admin: Mistral OCR settings + engine status dashboard; httpx<0.28 pin
  (TestClient breakage); Prometheus test fixture fixed
- marketing docs aligned with code (PDF+OCR, retention, engines, pricing)
- security: .env.ionos/.env.production/provider_settings.json removed

Tests: 1173 passed / 0 failed (6 network tests deselected: free Google
endpoint temporarily blocked from this machine)

tests/test_cleanup.py

@@ -101,7 +101,11 @@ def _get_redis_patcher(mock_redis):
 
 @pytest.mark.asyncio
 async def test_orphan_deletion(temp_dirs):
-    """Test that orphaned files are deleted as per Story 2.15 (AC: #4)"""
+    """Test that orphaned files are deleted as per Story 2.15 (AC: #4).
+
+    Since the security fix (audit 2026-08-26), an orphan is only deleted
+    after a grace period, so young in-flight files are never removed.
+    """
     cleanup_mod = _get_cleanup_module()
     FileCleanupManager = cleanup_mod.FileCleanupManager
 
@@ -117,6 +121,10 @@ async def test_orphan_deletion(temp_dirs):
 
     manager = FileCleanupManager(uploads, outputs, temp, cleanup_interval_minutes=5)
 
+    # Make the orphan older than the grace period (default 15 min)
+    old = time.time() - (manager.orphan_grace_seconds + 60)
+    os.utime(orphan_file, (old, old))
+
     mock_redis = AsyncMock()
     mock_redis.keys.return_value = ["translation:file:job1"]
     mock_redis.get.return_value = json.dumps(
@@ -182,6 +190,11 @@ async def test_cleanup_resilience(temp_dirs):
     f2 = uploads / "file2.txt"
     f2.write_text("file2")
 
+    # Make the files older than the grace period so cleanup actually deletes them
+    old = time.time() - 7200
+    os.utime(f1, (old, old))
+    os.utime(f2, (old, old))
+
     manager = FileCleanupManager(uploads, outputs, temp, max_file_age_minutes=1)
 
     original_unlink = Path.unlink