feat: remove .html and .svg from allowed upload types and MIME mappings

Remove HTML and SVG file extensions from the ALLOWED_UPLOAD_TYPES dictionary and their corresponding MIME type entries from MIME_TO_EXT in attachments.py, preventing users from uploading these potentially unsafe file formats through the API.

tests/e2e/bookmarks/saved.py

@@ -131,7 +131,7 @@ def test_audit_log_pagination_preserves_filters(alice):
     assert "event_key=security.authz.denied" in href
     assert "page=2" in href
     next_link.first.click()
-    page.wait_for_url("**page=2**", wait_until="domcontentloaded")
+    page.wait_for_url("**/admin/audit-log?**page=2**", wait_until="domcontentloaded")
     assert "event_key=security.authz.denied" in page.url
     # the filter is still applied on page 2: every visible event badge matches
     badges = page.locator(

tests/e2e/comments/delete.py

@@ -47,7 +47,7 @@ def test_delete_comment_scrolls_to_previous_comment(alice):
     expect(page.locator(f".comment-text:has-text('{target}')")).to_have_count(0)
 
     page.wait_for_function(
-        "expected => Math.abs(window.scrollY - expected) < 120",
+        "expected => { const max = document.documentElement.scrollHeight - window.innerHeight; return Math.abs(window.scrollY - Math.min(expected, max)) < 120; }",
         arg=anchor_top,
     )
     expect(previous_wrapper).to_be_visible()

tests/e2e/feed.py

@@ -592,7 +592,7 @@ def test_feed_resources_docs_link(alice):
     docs = _resources_panel(page).locator("a.sidebar-link:has-text('Docs')")
     assert docs.get_attribute("href") == "/docs"
     docs.click()
-    page.wait_for_url(f"{BASE_URL}/docs", wait_until="domcontentloaded")
+    page.wait_for_url("**/docs/index.html", wait_until="domcontentloaded")
 
 
 def test_feed_resources_issues_link(alice):

tests/e2e/issues/create.py

@@ -8,8 +8,15 @@ SPINNER = "#create-issue-modal button[type='submit'] .btn-spinner"
 
 def _open_form(page):
     page.goto(f"{BASE_URL}/issues", wait_until="domcontentloaded")
-    page.click("button:has-text('Report Issue')")
-    page.fill("#issue-title", "Spinner regression title")
+    trigger = page.locator("button:has-text('Report Issue')")
+    title = page.locator("#issue-title")
+    trigger.click()
+    try:
+        title.wait_for(state="visible", timeout=5000)
+    except Exception:
+        trigger.click()
+        title.wait_for(state="visible", timeout=10000)
+    title.fill("Spinner regression title")
     page.fill("#issue-description", "Steps to reproduce the spinner regression")