Resolve audited open issues

[baixiangcpp]

Summary

• Fixes strict raster upload validation, generated direct tool redirects, TOTP validation, ID validation, cURL parsing/code generation, QR downloads and browser-local QR decode recovery, CSV losslessness/export safety, regex worker isolation, input ownership, first-load stability, route container widths, and tool input sizing intents.
• Addresses PR review findings: generic extension-matched uploads now defer raster trust to signature validation; random TOTP secrets are canonical Base32; blank CSV records are ignored; and WebCrypto byte inputs work in the Node 20/jsdom test realm.
• Aligns content-template validation with the shared route-width contract and updates four static HTML performance ceilings by 1-2% for the intentional global container payload increase.
• Replaces the overlapping QR slice in Fix QR input and export UX #326 with the audited implementation on this branch.

Verification

• npm run lint -- --quiet
• npm run validate
• npm run build:post
• Targeted file-policy, TOTP, CSV, and content-template tests passed.
• Playwright smoke, route-width matrix, and PWA offline journeys passed before the review follow-up; the final changes are non-UI validation and TOTP crypto compatibility fixes.
• The latest GitHub Actions Node 20 run passed the full unit-test stage and reached the post-build gates; this push triggers the final complete run with the corrected budget and template checks.

Follow-up Validation

#7, #260, #262, and #263 remain open because they require upstream changes, real-device coverage, or assistive-technology validation that cannot be completed in this repository-only audit.

Closes #311, #320, #321, #322, #323, #324, #325, #327, #328, #329, #330, #331, #332, #333, #334

[cloudflare-workers-and-pages]

Deploying byteflow with    Cloudflare Pages

Latest commit:	c2ce2e1
Status:	✅  Deploy successful!
Preview URL:	https://f3667d5f.byteflow-c58.pages.dev
Branch Preview URL:	https://fix-open-issue-audit-2026-07.byteflow-c58.pages.dev

View logs

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 10cad8a20e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".