refactor: deduplicate sanitizeFilename, add template+sanitize unit tests, fix esc single-quote

src/__tests__/sanitize.test.ts

@@ -0,0 +1,24 @@
+import { describe, it, expect } from "vitest";
+import { sanitizeFilename } from "../utils/sanitize.js";
+
+describe("sanitizeFilename", () => {
+  it("passes normal filename through", () => {
+    expect(sanitizeFilename("report.pdf")).toBe("report.pdf");
+  });
+  it("replaces control characters", () => {
+    expect(sanitizeFilename("file\x00name.pdf")).toBe("file_name.pdf");
+  });
+  it("replaces quotes", () => {
+    expect(sanitizeFilename('file"name.pdf')).toBe("file_name.pdf");
+  });
+  it("returns default for empty string", () => {
+    expect(sanitizeFilename("")).toBe("document.pdf");
+  });
+  it("truncates to 200 characters", () => {
+    const long = "a".repeat(250) + ".pdf";
+    expect(sanitizeFilename(long).length).toBeLessThanOrEqual(200);
+  });
+  it("supports custom default name", () => {
+    expect(sanitizeFilename("", "invoice.pdf")).toBe("invoice.pdf");
+  });
+});