fix(ui): render PDFs with pdf.js instead of an iframe

On iOS the file viewer showed only the first page of a PDF, with no way
to scroll to the rest — the document had to be downloaded and opened in
another app. The cause was not ours: WebKit refuses to mount its PDF
viewer inside an <iframe>/<object>/<embed> and paints a static first-page
thumbnail instead. That hits Safari on iOS and every WKWebView, so the
native shell too. The full viewer only exists for a top-level navigation.

The desktop browsers do mount a viewer, but each mounts its own — Chrome's
toolbar, Safari's page-index sidebar — so the same document also looked
different on every machine.

Both are answered by drawing the pages ourselves. New <pdf-view>
(web/components/shared/pdf-view.js) renders a continuous scroll of canvas
pages on the vendored pdf.js, with a zoom control and a page counter, and
replaces the iframe for both native .pdf files and server-compiled LaTeX.

Three properties are load-bearing:

- pdf.js is imported lazily (~450 KB + a 1.2 MB worker), so a session that
  never opens a PDF never pays for it.
- Canvases are created and destroyed as pages scroll. iOS caps the total
  canvas backing store a page may hold and silently blanks canvases past
  it, so an eager render would come out empty on exactly the platform this
  was written for. Off-screen pages keep only a correctly-sized box, which
  is also what keeps the scrollbar honest.
- The text layer (selection, in-page find) is best-effort: it is
  transparent DOM over the pixels, so its failures are swallowed rather
  than surfaced.

Vendored from pdfjs-dist 6.2.108: pdf.min.mjs, pdf.worker.min.mjs, the
standard-font data (needed by PDFs that reference Helvetica/Times without
embedding them) and the .textLayer block of pdf_viewer.css. CJK cmaps are
deliberately left out. pdf.js 6 needs Safari/iOS 17.4+.

Verified in headless Chromium against both a synthetic 12-page PDF using
non-embedded Helvetica and a real 14-page paper with embedded fonts and
figures: all pages present, last page renders after scrolling, page 1
released off-screen, text layer populated, zoom re-renders at the new
scale, no JS errors.

web/css/mobile.css

@@ -797,6 +797,19 @@ mobile-app[data-native] .chat-page-input-area { padding-bottom: 10px; }
   gap: 8px;
 }
 
+/* PDF viewer (<pdf-view>): the desktop toolbar is mouse-sized. Give the zoom
+   buttons a real tap target — on mobile they are the *only* zoom, since
+   mobile.html ships `user-scalable=no` and pinch is disabled page-wide. */
+.mobile-file-viewer .pdfv-toolbar {
+  padding: 0.4rem 0.75rem;
+  gap: 0.5rem;
+}
+.mobile-file-viewer .pdfv-btn {
+  min-width: 44px;
+  min-height: 36px;
+  font-size: 1rem;
+}
+
 /* ── Settings ─────────────────────────────────────────────────────────────── */
 
 .mobile-settings {