fix(file-viewer): upgrade docx-preview to 0.4.1 to close w:sym innerHTML XSS - #9574

Summary

• Bump docx-preview 0.3.7 → 0.4.1 to close a stored XSS in the workspace DOCX preview
• 0.3.7's renderSymbol wrote the raw w:sym/@w:char attribute into span.innerHTML, so a crafted .docx (e.g. w:char="41;<img src=x onerror=…>") ran script on the app origin for any workspace member who previewed it
• Post-render sweeps can't fix this in-app: the renderer creates nodes in window.document, so the injected <img> loads and fires onerror before renderAsync resolves
• 0.4.1 parses w:char as hex (parseInt(…, 16)) and renders it as a text node; <style> elements are now built with text children instead of innerHTML
• renderAsync signature and options are unchanged; only renderDocument (unused) changed. No new dependencies (still just jszip); lazy chunk grows ~0.5 KB gzipped
• Existing sanitizeRenderedHyperlinks / stripEmbeddedFrames / renderAltChunks: false guards stay as-is — 0.4.1 still copies relationship targets into href unchecked and still has the alt-chunk srcdoc path

Type of Change

• Bug fix (security)

Testing

• Headless Chromium harness rendering a crafted .docx through renderAsync with the component's exact options, against both UMD and the ESM entry Next bundles (import → dist/docx-preview.mjs), served over HTTP so src=x 404s:
  • 0.3.7: injected <img> present, onerror executed (red)
  • 0.4.1: no <img>, no execution; legitimate Wingdings F04A symbol renders the identical code point (green)
• Rendering regression diff, 0.3.7 vs 0.4.1, across 14 real-world Word documents plus a generated one covering headings, runs, footnotes, hyperlinks, symbols, numbered/bulleted lists, tables, images, headers/footers, and page breaks: 13/15 pixel-identical with identical text, tags, anchors, and page sizes. The other 2 gain pages because 0.4.1 now honors paragraph-level w:pageBreakBefore (0.3.7 only honored it via styles) — page counts match the number of direct breaks exactly, matching Word
• tsc --strict on the component's renderAsync call against the new typings (lib check on)
• bun install --frozen-lockfile accepts the lockfile under the 7-day minimumReleaseAge gate (0.4.1 published 2026-09-21); integrity matches the audited tarball
• Lint, audits, type-check, and tests run in CI

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)