refactor: deduplicate sanitizeFilename, add template+sanitize unit tests, fix esc single-quote

src/routes/convert.ts

@@ -31,10 +31,7 @@ function isPrivateIP(ip: string): boolean {
   return false;
 }
 
-function sanitizeFilename(name: string): string {
-  // Strip characters dangerous in Content-Disposition headers
-  return name.replace(/[\x00-\x1f"\\\r\n]/g, "").trim() || "document.pdf";
-}
+import { sanitizeFilename } from "../utils/sanitize.js";
 
 export const convertRouter = Router();