fix(labs): serve the in-browser OCR engine from this origin

Local lab OCR reads a report photo on the device with tesseract.js, whose
defaults load the worker, the WebAssembly core and the language data
from cdn.jsdelivr.net. The production CSP allows workers and fetches only
from this origin, so the engine could not load; where it did load (dev),
the browser of anyone scanning a report contacted a third-party CDN.

The worker, the three LSTM core builds and the deu and eng best_int
language data (about 17 MB) are now copied from pinned packages into
public/tesseract/ at prebuild and predev, and createWorker is pointed at
them with the worker started from its URL rather than a blob. A test
holds the options against the staged file list.

package.json

@@ -26,8 +26,8 @@
   "scripts": {
     "prepare": "node scripts/prepare.mjs",
     "dev": "next dev",
-    "predev": "node scripts/generate-i18n-boot.mjs",
-    "prebuild": "node scripts/generate-sw-version.mjs && node scripts/generate-i18n-boot.mjs",
+    "predev": "node scripts/generate-i18n-boot.mjs && node scripts/stage-tesseract-assets.mjs",
+    "prebuild": "node scripts/generate-sw-version.mjs && node scripts/generate-i18n-boot.mjs && node scripts/stage-tesseract-assets.mjs",
     "build": "NODE_OPTIONS=--max-old-space-size=8192 next build",
     "analyze": "ANALYZE=1 next build",
     "bundle-report": "node scripts/check-bundle-budget.mjs",
@@ -112,6 +112,8 @@
     "@next/bundle-analyzer": "^16.3.3",
     "@playwright/test": "^1.63.0",
     "@tailwindcss/postcss": "^4",
+    "@tesseract.js-data/deu": "1.0.0",
+    "@tesseract.js-data/eng": "1.0.0",
     "@testcontainers/postgresql": "^12.1.0",
     "@types/node": "26.5.1",
     "@types/pg": "^8.23.1",