fix: address review #4 — board name invalidation, SVG tests, test gaps

- Pass board.name to all invalidateBoardCache calls (permission mutations)
- Align integration create invalidation with update/delete
- Add initial-fetch-failure test for integration-data-cache
- Expand SVG XSS test corpus (javascript:, xlink:href, @import, onbegin)
- Forbid <style> tags in SVG sanitizer to prevent CSS injection
- Fix duplicate export in packages/common/src/index.ts

packages/api/src/integration-data-cache.ts

@@ -1,6 +1,7 @@
 // ponytail: module-level cache is single-instance only.
 // Multi-instance deployments (REDIS_IS_EXTERNAL=true) bypass this entirely —
 // each request calls the upstream fetcher directly.
+// isMultiInstance is read at module load; bypass behavior is verified via code review, not unit tests.
 const isMultiInstance = process.env.REDIS_IS_EXTERNAL === "true";
 
 interface CachedEntry<T> {