✨[Feat] Add local PDF OCR foundation

[maruson08]

Problem

Secure Tools has local PDF rendering and local OCR, but no shared contract that safely composes them page by page. Future PDF-to-text and Searchable PDF work needs typed results, actual progress, cancellation, stale-result protection, and bounded resource use without introducing another renderer or OCR engine.

Result

• adds a strict TypeScript PDF OCR service that reuses the existing same-origin PDF.js renderer and Tesseract service
• processes selected or all pages sequentially at a deterministic 2x render scale
• returns explicit { pageNumber, text } results with real render/OCR progress
• cancels PDF rendering and OCR together, blocks stale callbacks, supports retry/source replacement, and releases each page canvas immediately
• adds unit and browser integration coverage, including real one-page PDF OCR, multi-page/larger-page rendering, cancellation timing, and same-origin request checks
• keeps this Sprint foundation-only: no public route and no searchable PDF generation

Validation

• npm ci --ignore-scripts
• npm run prepare:ocr
• npm run typecheck
• npm test
• npm run build
• node scripts/validate-build.mjs
• node tests/ocr-smoke.test.mjs
• git diff --check
• PDF OCR browser harness: PASS: PDF OCR — HELLO
• browser route, redirect, six-locale, theme, and console regression QA

Closes #98