fix: content-based SVG detection, guard tests, document REDIS_CACHE_DB

- Detect SVG by content (magic bytes) in addition to MIME type to prevent
  sanitization bypass via mislabeled uploads
- Add guard test verifying DOMPurify actually strips dirty payloads
- Add looksLikeSvg detection test
- Document REDIS_CACHE_DB in .env.example

.env.example

@@ -55,6 +55,10 @@ TURBO_TELEMETRY_DISABLED=1
 # Example: DOCKER_SOCKET_PATHS=/var/run/docker.sock,/run/user/1000/podman/podman.sock
 # DOCKER_SOCKET_PATHS=
 
+# Redis DB index for the Next.js cache handler (default: 1).
+# Separate from the main pub/sub DB (0) to allow independent FLUSHDB.
+# REDIS_CACHE_DB=1
+
 # Enable kubernetes tool
 # ENABLE_KUBERNETES=true