Harden AI APIs and improve accessibility

[codberce]

Summary

• validate uploaded work using image signatures, safe decoding, dimension limits, and normalized JPEG output before AI processing
• reject unsupported content types and oversized grading or barem-chat requests
• add a bounded, privacy-safe CSP reporting endpoint and strengthen the report-only policy
• add Romanian not-found handling and reject unsupported finite route parameters
• add skip navigation, clearer mobile-menu state and focus handling, and consistent sticky-header spacing
• patch the production Sharp resolution and fix standalone TypeScript errors in tests
• remove an archive entry whose upstream barem is permanently unavailable

Validation

• pnpm test (319 tests)
• pnpm exec tsc --noEmit
• pnpm exec eslint . --ignore-pattern .pi
• pnpm build
• pnpm audit --prod
• exam, olympiad, and internal-link checks