fix: concurrent cache miss, SVG output, narrowed error handling, format

- Fix integration data cache: check pending promise before TTL to
  prevent returning undefined on concurrent cold-cache access
- Add concurrent-miss test (two parallel callers, one fetch)
- SVG sanitizer: extract <svg> from DOMPurify output to strip
  residual HTML wrapper
- Narrow safeRevalidateTag catch: log unexpected errors, silence only
  known "outside request scope" messages
- Run oxfmt across all packages (206 files formatted)

packages/api/src/integration-data-cache.ts

@@ -31,12 +31,12 @@ export const getCachedIntegrationData = async <T>(
   const now = Date.now();
 
   if (existing) {
-    if (now - existing.timestamp < ttlMs) {
-      return existing.data;
-    }
     if (existing.pending) {
       return existing.pending;
     }
+    if (existing.timestamp > 0 && now - existing.timestamp < ttlMs) {
+      return existing.data;
+    }
   }
 
   const pending = fetcher()