✨ Sprint 16A — Local OCR Foundation

[maruson08]

Secure Tools needs a reusable OCR layer before exposing Image → Text. This change adds a pinned, same-origin Tesseract.js 7.0.0 runtime with English and Korean models, an orientation-aware OCR service, explicit worker reuse/disposal and cancellation, and no public OCR route or navigation changes.

The preparation pipeline reproduces the committed browser engine, direct worker, complete Tesseract.js Core 7.0.0 runtime set, and eng/kor language data from the lockfile. Missing local assets fail closed without a CDN fallback. Tesseract may cache static model bytes, while user images, filenames, decoded pixels, recognized text, and OCR history remain unpersisted.

Validation:

• npm ci --ignore-scripts
• npm run build
• npm test
• node tests/ocr-smoke.test.mjs
• browser smoke under the production-equivalent CSP: real “HELLO” recognition, direct same-origin worker, no CSP/console errors, no app-originated third-party runtime requests
• git diff --check HEAD~2..HEAD

Closes #74