fix(datasets): accept BigTIFF headers and sanitise object keys

F1: ValidateFileContent rejected the pipeline's own output. GDAL writes a
BigTIFF header ("II+\0" / "MM\0+") whenever BIGTIFF=IF_SAFER kicks in for a
large raster, so accept both alongside the classic TIFF magic and reword the
error to "file is not a valid TIFF/BigTIFF GeoTIFF". GodalIO.Create now
delegates to an unexported createGTiff so a test can force BIGTIFF=YES and
assert the produced header passes the check.

F3: a user-supplied filename went straight into the S3 object key for dataset
uploads and for both dataset and dataset-group SLD uploads, so "../../x.sld"
escaped the dataset's own prefix. Reduce every such name to its base with a
shared safeObjectName helper, rejecting names with no usable base.

F9: rename the shadowing inner "raw" in the PATCH dg_id case to "s".

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

internal/domain/dataset.go

@@ -127,9 +127,23 @@ func ExtensionAllowedFor(ft FileType, ext string) bool {
 func ValidateFileContent(ext string, head []byte) error {
 	switch ext {
 	case ".tif", ".tiff":
-		// TIFF: little-endian "II*\0" or big-endian "MM\0*".
-		if !bytes.HasPrefix(head, []byte("II*\x00")) && !bytes.HasPrefix(head, []byte("MM\x00*")) {
-			return fmt.Errorf("file is not a valid TIFF/GeoTIFF")
+		// Classic TIFF: little-endian "II*\0" or big-endian "MM\0*".
+		// BigTIFF (version 43) uses "II+\0" / "MM\0+"; GDAL writes it for
+		// large rasters (BIGTIFF=IF_SAFER), so the pipeline's own COG output
+		// must pass this check too.
+		tiffMagic := [][]byte{
+			[]byte("II*\x00"), []byte("MM\x00*"),
+			[]byte("II+\x00"), []byte("MM\x00+"),
+		}
+		ok := false
+		for _, m := range tiffMagic {
+			if bytes.HasPrefix(head, m) {
+				ok = true
+				break
+			}
+		}
+		if !ok {
+			return fmt.Errorf("file is not a valid TIFF/BigTIFF GeoTIFF")
 		}
 	case ".zip":
 		// ZIP local-file or empty-archive signature.