fix: MV-9 pdf.js getDocument hardened — isEvalSupported:false + disableFontFace/Range/Stream on Codex PDF import

@@ -271,7 +271,20 @@271271   let pdf: Awaited<ReturnType<typeof pdfjsLib.getDocument>["promise"]>;272272   try {273273     const arrayBuffer = await file.arrayBuffer();274-    pdf = await pdfjsLib.getDocument({ data: arrayBuffer }).promise;274+    // MV-9: this parses arbitrary user-selected PDFs. The popup CSP already275+    // blocks eval, but disable pdf.js's eval-dependent font paths in depth276+    // (CVE-2024-4367 class), and turn off features Aztec extraction never277+    // needs.278+    pdf = await pdfjsLib.getDocument({279+      data: arrayBuffer,280+      // isEvalSupported is a valid pdf.js runtime option (defends the281+      // CVE-2024-4367 eval-via-font path) but is absent from pdfjs-dist282+      // 5.7.284's DocumentInitParameters typings — cast to add it.283+      isEvalSupported: false,284+      disableFontFace: true, // fonts not needed for Aztec bitmap extraction285+      disableRange: true,    // whole buffer already in memory286+      disableStream: true,   // ditto287+    } as Parameters<typeof pdfjsLib.getDocument>[0]).promise;275288   } catch (err) {276289     return {277290       chunksFound: 0,