perf(api): remplacer unar/pdftoppm par unrar crate et pdfium-render

CBR: extract_cbr_page extrayait TOUT le CBR sur disque pour lire une
seule page. Reécrit avec le crate unrar : listing en mémoire + extraction
ciblée de la page demandée uniquement. Zéro subprocess, zéro temp dir.

PDF: render_pdf_page utilisait pdftoppm subprocess + temp dir. Reécrit
avec pdfium-render in-process. Zéro subprocess, zéro temp dir.

CBZ: sort naturel (natord) pour l'ordre des pages.

Dockerfile API: retire unar et poppler-utils, ajoute libpdfium.so.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/api/Dockerfile

@@ -22,12 +22,26 @@ RUN --mount=type=cache,target=/sccache \
     cargo install sqlx-cli --no-default-features --features postgres --locked
 
 FROM debian:bookworm-slim
+
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    ca-certificates wget unar poppler-utils locales postgresql-client \
+    ca-certificates wget locales postgresql-client \
     && rm -rf /var/lib/apt/lists/*
 RUN sed -i '/en_US.UTF-8/s/^# //g' /etc/locale.gen && locale-gen
 ENV LANG=en_US.UTF-8
 ENV LC_ALL=en_US.UTF-8
+
+# Download pdfium shared library (replaces pdftoppm subprocess)
+RUN ARCH=$(dpkg --print-architecture) && \
+    case "$ARCH" in \
+        amd64) PDFIUM_ARCH="linux-x64" ;; \
+        arm64) PDFIUM_ARCH="linux-arm64" ;; \
+        *) echo "Unsupported arch: $ARCH" && exit 1 ;; \
+    esac && \
+    wget -q "https://github.com/bblanchon/pdfium-binaries/releases/latest/download/pdfium-${PDFIUM_ARCH}.tgz" -O /tmp/pdfium.tgz && \
+    tar -xzf /tmp/pdfium.tgz -C /tmp && \
+    cp /tmp/lib/libpdfium.so /usr/local/lib/ && \
+    rm -rf /tmp/pdfium.tgz /tmp/lib /tmp/include && \
+    ldconfig
 COPY --from=builder /app/target/release/api /usr/local/bin/api
 COPY --from=builder /usr/local/cargo/bin/sqlx /usr/local/bin/sqlx
 COPY infra/migrations /app/migrations