feat: vendor all browser deps into the image (no runtime CDN)

esm.sh's degraded storage backend served an unpinned transitive
@codemirror/view@^6.27.0 range URL as text/plain, which browsers block for
a disallowed MIME type. A failed top-level module import aborts the whole
<script type=module>, so the language/model dropdowns came up empty despite
a healthy backend — and top-level version pinning can't fix a transitive
range.

Add a frontend/ esbuild stage (Node stage in the Dockerfile) that vendors
everything into static/vendor and serve only from there:
- CodeMirror (view/state/commands) bundled into one self-contained ESM file
- cropperjs (+ CSS) copied from npm dist
- Tesseract.js engine + wasm core + Dutch (nld) language pack; OCR assets
  stay lazy (fetched only when a scan runs) and fully local
- Drop vim mode (@replit/codemirror-vim); keep document-level Shift-H/L

Google Fonts remains the only external <link> (degrades gracefully, not in
the failing path). Bump to 0.5.0.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Dockerfile

@@ -1,5 +1,17 @@
 # syntax=docker/dockerfile:1.7
 
+# Frontend stage: vendor all browser dependencies (CodeMirror, cropperjs,
+# Tesseract.js + wasm core + the Dutch language pack) into static/vendor so the
+# running container serves everything locally — no esm.sh / CDN at runtime.
+# Pinned to the build platform: the output is architecture-neutral browser
+# assets, so there's no need to re-run it under emulation for each target arch.
+FROM --platform=$BUILDPLATFORM node:22-slim AS frontend
+WORKDIR /app/frontend
+COPY frontend/package.json frontend/package-lock.json ./
+RUN npm ci
+COPY frontend/ ./
+RUN node build.mjs
+
 # Build stage: install deps into a venv with uv.
 FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim AS builder
 
@@ -22,6 +34,7 @@ WORKDIR /app
 COPY --from=builder /app/.venv /app/.venv
 COPY app.py ./
 COPY static ./static
+COPY --from=frontend /app/static/vendor ./static/vendor
 
 EXPOSE 8000