v0.1b phase 1: model-pack boundary and local validation

[drdeepaksatheesh]

Implements issue #16 phase 1.

What changes

• adds a typed TranslationProvider boundary;
• removes automatic reference-engine use from normal Translate;
• adds strict model-pack manifest parsing in TypeScript;
• adds Rust/Tauri local model-pack discovery/import with SHA-256 validation and path-traversal protection;
• installs packs under app data, never inside the application binary;
• adds no-pack UX and explicit local model-pack import;
• leaves Explain on the reference path for now;
• keeps SourceAnchor, GeneratedRecord provenance and document-sidecar schemas unchanged;
• adds a tiny synthetic non-model pack fixture for GUI trust-boundary testing;
• bumps app to 0.1.0-alpha.3 / UI v0.1b.

Deliberate limitation

A validated real model pack can now be discovered/imported and selected, but its inference worker is not connected in this phase. Translate returns a typed runtime_not_connected rather than silently falling back to canned output.

CI evidence

GitHub Actions run 35035327303: PASS.

• version consistency: PASS (0.1.0-alpha.3)
• unit tests including manifest/path/hash/provider selection: PASS
• production TypeScript/Vite build: PASS
• critical dependency audit: PASS
• Windows Tauri/NSIS build: PASS
• installer validation + SHA-256 manifest: PASS
• artifact upload: PASS

Validated installer:

• Open Document Understanding_0.1.0-alpha.3_x64-setup.exe
• SHA-256 ef4ee94772560f2fbf99e1f0288d1bad8824bff6fe0fb6e2c9579894f65a95f3

Documentation

• docs/MODEL_PACK_IMPORT.md
• docs/REAL_OFFLINE_HINDI_MODEL_PLAN.md
• ADR 0003
• model-pack JSON schema
• README / roadmap updated

Issue #16 intentionally remains open until a Windows GUI smoke test confirms: no-pack state -> synthetic pack import -> validated pack discovery after restart -> Translate reports worker-not-connected with no reference fallback.