chore(deps): drop pdf-parse and the second pdfjs-dist it carried

Nothing imports pdf-parse any more, so its pdfjs-dist 5.4.296 and the
older @napi-rs/canvas that came with it leave the lockfile. The override
that kept that transitive copy past a renderer advisory has nothing left
to move and goes too. The standalone tracing stops naming pdf-parse; its
pdfjs-dist glob now matches the one copy the app pins. The Dockerfile and
canvas guard comments describe the second copy as history.

Refs #1277

src/__tests__/canvas-binary-hoist-guard.test.ts

@@ -4,13 +4,14 @@
  *
  * ## The failure this freezes (GitHub #1124)
  *
- * The pnpm store holds two canvas versions: the one in package.json and an
- * older one that pdf-parse's own pdfjs-dist pulls in. The runner stage picked
- * the musl binary with `find | head -1`, got the old one, and copied it into
- * the new loader's directory, where the loader looks first. PDF rendering
- * still worked, so nothing looked wrong; `loadImage` called an
- * `Image.decode` the old binary lacks, and every preview thumbnail failed
- * with "image.decode is not a function" on both architectures.
+ * The pnpm store held two canvas versions: the one in package.json and an
+ * older one that a second, older pdfjs-dist pulled in (gone since #1277).
+ * The runner stage picked the musl binary with `find | head -1`, got the
+ * old one, and copied it into the new loader's directory, where the loader
+ * looks first. PDF rendering still worked, so nothing looked wrong;
+ * `loadImage` called an `Image.decode` the old binary lacks, and every
+ * preview thumbnail failed with "image.decode is not a function" on both
+ * architectures.
  *
  * ## What it proves and what it does not
  *