fix: gauntlet hardening — alignment regression tests, cleanup, DRY, docker labels

- test: 3 regression tests for textAlign/verticalAlign/containerId REST round-trip
  (Zod was silently stripping these fields before the schema fix)
- fix: pendingTitleTimerRef cleanup on unmount (App.tsx)
- fix: localStorage JSON.parse wrapped in try/catch to prevent crash (App.tsx)
- refactor: extract seedKnownContainers() helper — 4 identical loops → 1 (App.tsx)
- chore: remove unnecessary `as any` cast on subtitle element type (index.ts)
- docs: test counts updated to 446 (README.md, CLAUDE.md)
- chore: fix stale LABEL source URLs in Dockerfile and Dockerfile.canvas

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

README.md

@@ -14,13 +14,13 @@ Run a live Excalidraw canvas and control it from any AI agent. This repo provide
 - **SQLite Persistence**: Elements survive restarts, with versioning and search
 - **Multi-Tenancy**: Isolated canvases per workspace, auto-detected
 - **Security Hardened**: Helmet, rate limiting, API key auth, prototype pollution guard, WS challenge-response
-- **369 Tests**: Full test coverage across unit, API, WebSocket, and regression tests
+- **446 Tests**: Full test coverage across unit, API, WebSocket, and regression tests
 
 ## Why this fork?
 
 Forked from [celstnblacc/excalidraw-mcp-sentinel](https://github.com/celstnblacc/excalidraw-mcp-sentinel) (itself a fork of [yctimlin/mcp_excalidraw](https://github.com/yctimlin/mcp_excalidraw)) with production hardening:
 
-- **443 tests** (upstream has none) — unit, API, WebSocket, and regression
+- **446 tests** (upstream has none) — unit, API, WebSocket, and regression
 - **Security middleware** (`src/security.ts`): helmet, CORS allowlist, timing-safe API key auth, prototype pollution guard, input sanitization
 - **3-tier rate limiting**: general, destructive, and write-burst ceilings
 - **WebSocket challenge-response authentication**