fix(pdf): bundle PDF.js CMap/font assets so CJK documents render and index

[mrsibe]

What does this PR do?

Makes CJK (Chinese / Japanese / Korean) PDFs work end to end by wiring up PDF.js's three external asset roots — predefined CMaps, standard fonts and the wasm image decoders — for both consumers:

• main process (PdfLoader) reads them as filesystem paths, so getTextContent() returns the CJK text instead of dropping it;
• renderer (PdfSourceReader) reads them through a new knownote-asset:// protocol, so the canvas paints CJK and the text layer is selectable.

Ships pdfjs-dist/{cmaps,standard_fonts,wasm} with the app as real files under resources/pdfjs/ (electron-builder extraResources, outside app.asar).

Builds on #129 (merged), which put the reader on the pdfjs legacy build. A correct renderer still needs these assets.

Why?

The v1.4 QA (#125) found CJK PDFs broken in a way that a getDocument({ data }) call hides:

Warning: loadFont - translateFont failed:
"UnknownErrorException: Ensure that the `cMapUrl` API parameter is provided."

PDF.js treats CMaps / standard fonts / wasm as external assets fetched by filename (${cMapUrl}${name}.bcmap). Nothing passed any of the three, and the failure is a warning, not an exception — so the reader painted blank and the loader indexed the document without its CJK text. Both are release blockers: the second is a plausible part of why notebook chat could not retrieve CJK sources.

Reproduced against main with noembed-jis7.pdf (non-embedded Japanese font):

	extracted text	CJK present
no cMapUrl	"ABC 1231"	no
cMapUrl + cMapPacked	"ABCあいうえお123 1"	yes

Fixes #130. Related to #125, #129, #82.

What changed?

• electron-builder.yml: extraResources copies cmaps, standard_fonts, wasm to resources/pdfjs/. Real files, outside the asar — the main process reads them with fs, and Chromium cannot read inside app.asar.
• src/shared/utils/pdfjsAssets.ts: the shared contract (directory allowlist, protocol URL shape with the trailing slash PDF.js requires, and a parser that rejects traversal).
• src/main/protocol/pdfjsAssetProtocol.ts: knownote-asset://, mirroring knownote-doc://. The renderer names a directory; the main process resolves the file from an allowlisted root and serves it with CORS + application/wasm.
• src/main/pdfjsAssetPaths.ts: resolves the asset root (resources/pdfjs packaged, node_modules/pdfjs-dist in dev) and the three Node-side directory paths.
• PdfLoader.ts / PdfSourceReader.tsx: pass cMapUrl, cMapPacked: true, standardFontDataUrl, wasmUrl.
• index.html: connect-src gains knownote-asset:; script-src gains 'wasm-unsafe-eval'. 'unsafe-eval' is still absent, so the security(pdf): remediate GHSA-hq66-cqwq-w95j before v1.4 (pdfjs-dist 5.7.284 in affected range) #121 scripting boundary is unchanged.
• smokeTest.ts: packaged assertion that the three asset directories shipped and are non-empty.
• test/pdfjsAssets.test.ts: URL shape, traversal rejection, both call sites, and the CSP directives.

How was this tested?

• Real protocol handler + real pdfjs in headless Electron (39.8.10), against noembed-jis7.pdf, with the repo's actual registerPdfjsAssetScheme / registerPdfjsAssetProtocolHandler: text is "ABC あいうえお 1231" and page.render() resolves. CMaps fetched over the protocol: H.bcmap, Adobe-Japan1-UCS2.bcmap.
• Real PdfLoader in Node on the same fixture returns the Japanese text; without cMapUrl it returns "ABC 1231" and emits the warning above.
• npm test — 276 pass, 0 fail (5 new). The call-site guard was falsified by reverting cMapUrl in the reader, which fails it as intended.
• npm run typecheck, npm run build — pass.
• npm run build:unpack — ships cmaps 169, standard_fonts 16, wasm 13 under resources/pdfjs/.
• smoke:packaged — 21/21 checks pass, including the new packaged-assets check (run headless; CI uses xvfb-run).

Not verified: a CJK document end to end in the packaged window (canvas paint, text-layer selection). That needs a real CJK fixture and a display, and is manual QA for #125.

Screenshots / recordings

Not applicable (no bundled CJK fixture to screenshot), see "How was this tested?".

Checklist

• I have reviewed my own changes.
• npm run typecheck passes.
• npm run build passes.
• I have tested the affected user workflow.
• I have not included unrelated changes.
• I have updated documentation when necessary.

Desktop / build changes

• npm run build:unpack passes.
• npm run smoke:packaged passes.