feat: affichage PDF avec TOC + frame-src CSP

- CSP: ajout frame-src 'self' http://127.0.0.1:* (permet iframe PDF)
- pdf_reader.py: extract_pdf_toc() — extrait les bookmarks/outline (pypdf + pymupdf)
- main.py: inclut pdf_toc dans la réponse /api/file pour les PDF
- viewer.js: sidebar TOC avec liens vers les pages (si bookmarks présents)
- style.css: layout .pdf-body flex + .pdf-toc sidebar 240px

backend/main.py

@@ -2339,9 +2339,10 @@ async def api_file(vault_name: str, path: str = Query(..., description="Relative
     # === PDF: special handling before read_text (binary file) ===
     if ext == ".pdf":
         try:
-            from backend.pdf_reader import extract_pdf_metadata, extract_pdf_text
+            from backend.pdf_reader import extract_pdf_metadata, extract_pdf_text, extract_pdf_toc
             pdf_text = extract_pdf_text(file_path, max_chars=100000)
             pdf_meta = extract_pdf_metadata(file_path)
+            pdf_toc = extract_pdf_toc(file_path)
             size = file_path.stat().st_size
             return {
                 "vault": vault_name,
@@ -2356,6 +2357,7 @@ async def api_file(vault_name: str, path: str = Query(..., description="Relative
                 "is_pdf": True,
                 "unsupported": False,
                 "pdf_metadata": pdf_meta,
+                "pdf_toc": pdf_toc,
                 "size_bytes": size,
             }
         except Exception as e: