feat: add local OneNote and ONEPKG reader

THIRD_PARTY_NOTICES.md

@@ -0,0 +1,38 @@
+# Third-party notices
+
+The production application uses:
+
+- `@add-ideas/toolbox-contract` 0.1.1, Apache-2.0;
+- `@add-ideas/toolbox-shell-react` 0.1.1, Apache-2.0;
+- React, React DOM, and Scheduler, MIT.
+
+The release packager collects the complete installed runtime licence texts into
+`LICENSES/THIRD-PARTY-LICENSES.txt`.
+
+The native TypeScript OneStore/MS-ONE parser follows selected structures and
+traversal from `onenote.rs` (MPL-2.0), pinned at
+`5138a39a3f4e72b840932f9872fecde52fa9da60`. Adapted source files carry MPL
+provenance headers.
+
+The browser-native CAB parser/checksum implementation is a translated and
+security-bounded adaptation of `rust-cab` (MIT), pinned at
+`c5839f5fdfa4c4e7cc9b22f570c79c96af0560e2`. The LZX decoder is a translated
+adaptation of `lzxd` 0.2.5 (MIT OR Apache-2.0), pinned at
+`4748e43594e3e30cff2ace3a6ad7a376c9816fdd`; this project uses it under the MIT
+option. Adapted modules carry provenance headers and the licence texts are in
+`LICENSES/rust-cab-MIT.txt` and `LICENSES/lzxd-MIT.txt`.
+
+The Base64-encoded `onenote_desktop.one` test fixture comes from Joplin at
+commit `28eb53bd9f0cd4ae0dec0c59a08037075a38302b` and is distributed under
+AGPL-3.0-or-later. Its licence text is in `LICENSES/AGPL-3.0.txt`.
+
+The Base64-encoded Joplin `test.onepkg` fixture is pinned at commit
+`1e73aad7eb08fde5d9e4cb533df40052a5cd32d7` and is likewise test-only data
+distributed under AGPL-3.0-or-later.
+
+The encoded fixture bytes are excluded from `dist` and the release ZIP. The
+release retains the fixture provenance document and AGPL text so these notices
+remain complete.
+
+The remaining npm packages are build and test tooling and are not shipped as
+runtime modules in the static application.