fix(media): narrow MIME_MAP to only .ts/.tsx text/plain, add regression tests

- Add only .ts→text/plain and .tsx→text/plain to MIME_MAP (exclude .js,
  .jsx, .css and other unsafe mappings that would make workspace files
  executable as same-origin scripts)
- Add test_ts_artifact_served_as_text_plain_with_attachment — asserts
  Content-Type: text/plain, Content-Disposition: attachment, and
  X-Content-Type-Options: nosniff for .ts files via /api/media
- Add test_tsx_artifact_served_as_text_plain_with_attachment — same for .tsx
- Add test_file_raw_js_not_served_as_inline_executable — proves that a
  workspace .js file falls through to application/octet-stream instead of
  text/javascript via /api/file/raw

Closes #6372

api/config.py

@@ -1052,6 +1052,10 @@ MIME_MAP = {
     ".m4v": "video/mp4",
     ".webm": "video/webm",
     ".ogv": "video/ogg",
+    # TypeScript source files — served as text/plain to avoid XSS from
+    # same-origin inline execution in _handle_file_raw.
+    ".ts": "text/plain",
+    ".tsx": "text/plain",
 }
 
 # ── Toolsets (from config.yaml or hardcoded default) ─────────────────────────