test: bring the 82 unmarked test files into the offline gate (fix rotted path-prefix + SVG tests) - #4035

Summary

CI's offline gate (pytest tests/ -m offline) never ran the 91 files the issue found unmarked — on c7e7a24f it collected 7,743 of 9,428 tests. Of those, 82 files (1,505 tests) carried no marker at all, so no CI job selected them in any mode; pytest_collection_modifyitems only auto-skips integration, so unmarked files are simply invisible.

Every one of the 82 files runs hermetically against mocks / TestClient / monkeypatching (the postgres_impl, qdrant_impl, milvus_impl, neo4j_impl suites construct fakes or patch the connection layer; the api/ suites drive create_app() with LightRAG mocked). They are marked offline with the repo's existing module-level pytestmark = pytest.mark.offline convention. None needed integration/requires_db — the empirical run of the full unmarked set passes with only conditional skips.

Four rotted tests had real causes, all traced to 2ea2814 (2026-08-29) landing after the file was written (08-19) — with CI never running the file, nothing caught the drift:

• 307-instead-of-200 pair (test_mount_strip_mode_matches, test_mount_verbatim_mode_matches): these exercise the root_path normalization middleware through the WebUI Mount. But create_app only mounts the WebUI StaticFiles when the bun build artifacts exist; on any bare checkout/CI they don't, so /webui/ fell through to the redirect-to-/docs fallback (307) without ever reaching the middleware under test. Fixed by staging a minimal webui/index.html build dir + patching check_frontend_build, the same pattern test_workspace_entry_mount.py already uses.
• 403-instead-of-401 pair (test_destructive_route_requires_auth_under_a_colliding_prefix[verbatim|strip]): combined_dependency has answered 403 "API Key required" for "API key configured, none presented" since 2ea2814. The property the test is named for is "requires auth", which holds either way; the assertion is now in (401, 403) with the reasoning in the docstring. Which single code should be canonical is left as the maintainer's call, per the issue.
• 5 SVG tests (surfaced by bringing tests/parser/markdown/ into the gate): cairosvg is a cffi binding — the wheel installs but rendering needs native libcairo, absent from stock macOS and stock python:3.12-slim. The parser itself treats this as an optional capability (check_svg_rasterizer() startup probe). The 4 tests that assert on real PNG output now skip on that probe (mirroring the requires_spacy_models skip pattern), and the cache-hit guard test patches md_parser._rasterize_svg instead of importing cairosvg, so it runs everywhere.

Verification

Before (c7e7a24): uv sync --frozen --extra api --extra offline-storage --extra offline-llm --extra pytest

pytest tests/ -m offline --collect-only -q   → 7,743/9,428 collected (1,685 deselected)
pytest tests/ -m offline                     → 314 failed, 7,382 passed, 48 skipped

After:

pytest tests/ -m offline --collect-only -q   → 9,248/9,428 collected (180 deselected)   (+1,505)
pytest tests/ -m offline                     → 314 failed, 8,766 passed, 169 skipped

The 314 failures are byte-identical on main and on this branch (tests/setup/* — they shell out to scripts/setup/setup.sh, which hard-requires Bash ≥ 4; macOS dev machines ship 3.2). Zero new failures; +1,384 passing; +121 skips are the new conditional guards (spaCy models, cairo native lib, docling). On CI's ubuntu runners (Bash 5) the setup suite passes, so the offline job is expected to be fully green.

The 4 originally-rotted tests plus the SVG set now pass locally (tests/api/test_path_prefixes.py: 34 passed; tests/parser/markdown/: 44 passed + 4 cairo-skips without libcairo, 48/48 with it).

Notes for reviewers

• Scope: this covers the ~80 unmarked files from the issue (option 1). The remaining deselected 180 are files explicitly marked integration/requires_db/requires_api — not touched.
• The 401-vs-403 question the issue raises is deliberately not decided here; if you prefer 401 as the canonical "missing credentials" code, that's a one-line change in combined_dependency plus these two assertions going back to == 401.

Closes #4033