refactor(font): remove the PDFBox-typed API and FontShowcase from the core font package

[DemchaAV]

Why

Ahead of the 2.0 Maven module split, the core com.demcha.compose.font package must stop reaching into the PDF backend so it can live in a lean, backend-neutral core. Today it does so in two places: DefaultFonts exposes PDDocument-typed methods, and FontShowcase composes a preview through the document DSL. This PR removes both. (It is a partial cycle break by design — see Scope below.)

What changed

• DefaultFonts drops the PDFBox leak. library(PDDocument) and library(PDDocument, Collection<FontFamilyDefinition>) were thin delegators to document.backend.fixed.pdf.PdfFontLibraryFactory, which already exposes the identical methods. They're removed and the (all test-scope) callers now call the factory directly. compose.font no longer imports org.apache.pdfbox anywhere.
• FontShowcase moves to document.backend.fixed.pdf. It builds a font-preview document via the DSL and renders it, so it belongs with the PDF backend it rides. Its two tests move alongside, and its public methods gain javadoc — the pdf package is javadoc-gated (doclint=all); the font package was not. GraphCompose.renderAvailableFontsPreview() imports it from the new home.
• Guard the invariant. PdfBackendIsolationGuardTest now also scans com.demcha.compose.font, so any future file that re-imports org.apache.pdfbox under the font catalog fails the build. The font package is the logical catalog — it names fonts, it never loads them.
• CONTRIBUTING.md package map updated to reflect FontShowcase's new home.

Scope (deliberately partial)

DefaultFonts.standardLibrary() — reached by engine.core.EntityManager's defaulting constructors — still delegates to PdfFontLibraryFactory, so compose.font retains that one non-PDFBox document import. Cutting it would force the engine to name the pdf backend directly (a forbidden engine → document edge) unless a backend seam supplies the default library; that belongs with the render/measurement seam, not here. Production never hits that default (no src/main constructs EntityManager without an injected library) — it is a test-only convenience.

Verification

• ./mvnw clean verify -pl . — green. Zero layout-snapshot updates and the FontShowcase render/snapshot tests pass, proving the rendered output is byte-identical.
• ./mvnw javadoc:javadoc -pl . — clean; FontShowcase's new method javadoc satisfies doclint=all in the (now-gated) pdf package.
• The new guard coverage was confirmed to bite, not pass vacuously: injecting an org.apache.pdfbox import into DefaultFonts turns PdfBackendIsolationGuardTest red on exactly that file.
• Grep-verified: zero remaining DefaultFonts.library(...) callers; zero org.apache.pdfbox imports under compose.font; no dangling references to the old com.demcha.compose.font.FontShowcase FQN.