feat: vendor all browser deps into the image (no runtime CDN)

esm.sh's degraded storage backend served an unpinned transitive
@codemirror/view@^6.27.0 range URL as text/plain, which browsers block for
a disallowed MIME type. A failed top-level module import aborts the whole
<script type=module>, so the language/model dropdowns came up empty despite
a healthy backend — and top-level version pinning can't fix a transitive
range.

Add a frontend/ esbuild stage (Node stage in the Dockerfile) that vendors
everything into static/vendor and serve only from there:
- CodeMirror (view/state/commands) bundled into one self-contained ESM file
- cropperjs (+ CSS) copied from npm dist
- Tesseract.js engine + wasm core + Dutch (nld) language pack; OCR assets
  stay lazy (fetched only when a scan runs) and fully local
- Drop vim mode (@replit/codemirror-vim); keep document-level Shift-H/L

Google Fonts remains the only external <link> (degrades gracefully, not in
the failing path). Bump to 0.5.0.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/codemirror.js

@@ -0,0 +1,6 @@
+// Single entry point re-exporting every CodeMirror symbol index.html needs.
+// esbuild bundles this (and the whole transitive @codemirror/@lezer graph)
+// into one self-contained ESM file — no runtime CDN, no semver-range URLs.
+export { EditorView, keymap, placeholder } from "@codemirror/view";
+export { EditorState } from "@codemirror/state";
+export { history, defaultKeymap, historyKeymap } from "@codemirror/commands";