fix: code-review findings in the print module

Security and robustness:
- EXIF orientation is now applied before any geometry. Phone photos carry the
  rotation only as metadata; sharp was cropping the unrotated raster, so a
  portrait shot came out of the printer sideways and wrongly framed.
- renderCell no longer materialises the padded image at source resolution.
  It is one extract-resize-extend chain now, which is also sharp's internal
  order. A panorama into a narrow contain target used to build a ~960 MB
  intermediate and then fail; it is 90 ms and a few MB now.
- Target size is capped (300 Mpx) and bleedMm is clamped in /api/print/single,
  which had no bound at all.
- The delivery gallery is validated before use - posixpath.join let a crafted
  name escape the target's base folder and create directories there.
- Sheet requests are capped at 500 pieces and the packer has a step budget, so
  a degenerate request cannot block the single-threaded server.
- Print presets: delete only your own (admins all), config size limit, count
  limit, and by_name honours anonymous_generations.
- Telegram callbacks require an active pairing, like every other path.
- Error responses no longer leak storage paths or delivery hostnames.

Correctness:
- allowRotate:undefined now means allowed, consistently with the packer.
- The many-formats shortcut no longer drops a format that only fits rotated.
- unplaced names the format that is actually missing, not the first one.
- Crop marks never sit inside the printed bleed - the offset is raised.
- capacity() computes the grid instead of probing with 200 copies.
- Image keys in the sheet cannot collide with a cell literally named x::rot.
- labelMm keeps real decimals; parseSizeMm reads a:b as width:height, so
  3:4/15 is portrait and 4:3/15 is landscape.
- The footer is skipped when there is no free space at the bottom.
- The UI warns when corner marks do not fit the margin, and when continuous
  guides are used with mixed sizes.

Tests: 21 -> 31, each finding has a regression test.

src/pages/api/print/single.ts

@@ -34,7 +34,7 @@ export const POST: APIRoute = async ({ request, locals }) => {
     const fit = body?.fit === 'contain' ? 'contain' : 'cover';
     const background = /^#[0-9a-f]{6}$/i.test(String(body?.bg || '')) ? String(body.bg) : '#ffffff';
     const out = await renderCell(buf, crop, size.w, size.h, dpi,
-      { ext, bleedMm: Number(body?.bleedMm) || 0, fit, background });
+      { ext, bleedMm: Math.min(10, Math.max(0, Number(body?.bleedMm) || 0)), fit, background });
 
     // Hinweis, falls die Quelle für echte 300 dpi zu klein ist.
     const cropW = (crop?.w ?? 1) * out.srcPx[0];
@@ -50,7 +50,10 @@ export const POST: APIRoute = async ({ request, locals }) => {
       },
     });
   } catch (e: any) {
-    return json({ error: e?.message || 'Bild konnte nicht erzeugt werden.' }, 400);
+    console.error('[print/single]', e?.message || e);
+    const m = String(e?.message || '');
+    const safe = /^(Maß|Ungültige|Unbekannte|Bild nicht|Kein Zugriff|Quelle|Ausschnitt|Zielbild)/.test(m);
+    return json({ error: safe ? m : 'Bild konnte nicht erzeugt werden.' }, 400);
   }
 };