build(web): restore the wasm build — gate native-only deps off wasm

The web build had bit-rotted: native-only features added since it last
compiled pulled crates that don't build for wasm32-unknown-unknown.

- printpdf (PDF export / printing) → native-only target; the web build gets
  stub export_pdf / print_wires. It pulls a wasm-incompatible memchr 1.0.2
  via lopdf → nom_locate, and the web has no filesystem.
- getrandom 0.3 (via ahash via acadrust) → enable its wasm_js feature and add
  the matching --cfg getrandom_backend rustflag in .cargo/config.toml.
- ocs_plugin_api "host" feature (out-of-process plugin runtime: interprocess,
  libloading, memmap2, rkyv) → native-only target; the web gets the
  dependency-free manifest/ribbon contract. The host code was already
  wasm-gated; only the Cargo wiring pulled it in unconditionally.

`trunk build --release` succeeds again.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.cargo/config.toml

@@ -0,0 +1,6 @@
+# getrandom 0.3 (pulled by ahash via acadrust) needs this cfg to select its
+# browser backend on wasm32-unknown-unknown, alongside its `wasm_js` feature
+# (enabled in Cargo.toml for the wasm target). Without it the web build fails
+# with "wasm32-unknown-unknown targets are not supported by default".
+[target.wasm32-unknown-unknown]
+rustflags = ['--cfg', 'getrandom_backend="wasm_js"']