Docs: document PDF.js auxiliary assets and CSP requirements

## Summary

Lector's docs should call out that production deployments may need to self-host PDF.js runtime assets and configure `documentOptions`, especially when the app uses a strict Content Security Policy.

We hit this with scanned/image-heavy contract PDFs. The PDF loaded, page count resolved, and Lector mounted, but pages rendered blank or partially blank. The browser console showed PDF.js failures such as:

```txt
JpxError: OpenJPEG failed to initialize
Unable to decode image
Dependent image isn't ready yet
```

The underlying cause was that PDF.js attempted to load auxiliary assets such as WASM, standard fonts, CMaps, or ICC profiles from a CDN path, but our CSP only allowed same-origin scripts/fonts/assets. Once we copied PDF.js assets into `public/pdfjs/` and pointed `documentOptions` to same-origin URLs, default Lector rendered the same PDFs correctly.

## Suggested docs coverage

A production/CSP section could show:

```tsx
import { GlobalWorkerOptions } from "pdfjs-dist/legacy/build/pdf.mjs";

GlobalWorkerOptions.workerSrc = "/pdfjs/pdf.worker.mjs";

const documentOptions = {
wasmUrl: "/pdfjs/wasm/",
cMapUrl: "/pdfjs/cmaps/",
cMapPacked: true,
standardFontDataUrl: "/pdfjs/standard_fonts/",
iccUrl: "/pdfjs/iccs/",
};
```

And mention CSP directives such as:

```txt
script-src 'self' 'wasm-unsafe-eval'
font-src 'self' data:
```

## Why this matters

This failure mode looks like a rendering bug at first, because normal metadata/page loading can still work while scanned/JPEG2000-heavy page content is blank. A short docs note would save users from debugging Lector layers, CSS, workers, and canvas rendering when the real issue is blocked PDF.js auxiliary assets.