fix(pipeline): charts/diagrams now ship when user asks for them

[CesarManzoCode]

Three coordinated fixes so a request like "imágenes, diagramas y gráficas
OBLIGATORIAS" produces all three in the final .docx instead of only one
image-class output.

1. Mermaid renderer

   • Chromium under the unprivileged container user was crashing with
     "chrome_crashpad_handler: --database is required" because HOME and
     the user-data-dir were unwritable. Dockerfile now provisions a
     dedicated HOME and XDG dirs for studymation and the puppeteer args
     pin --user-data-dir, --disable-crashpad and friends.
   • DiagramRenderer.render now cascades: local mmdc first, then a
     mermaid.ink HTTPS fallback. Preflight returns True whenever any
     renderer is reachable so the orchestrator stops warning when only
     the local binary is broken.

2. Visual auditor

   • Detects explicit user intent (gráficas/diagramas/tablas/etc.) in
     user_notes; scales the placement cap up to ~1 per section and tells
     the LLM in the system prompt that both types are obligatory.
   • If the auditor still omits the requested type, _force_placement
     reserves a slot in the best eligible section so the injector can
     generate it.
   • chart_extraction_system_prompt(force_generation=True) refuses to
     return null when the user asked for charts: synthesises illustrative
     data instead of skipping silently.

3. Image download

   • upload.wikimedia.org was returning 429 for the 3rd image in a row
     and we dropped it. _download_and_normalize_image now retries 429/5xx
     up to 3 times with exponential backoff and honors Retry-After.

Includes regression tests for user-intent detection, scaled placement
caps and the _force_placement fallback.