feat: add local OneNote and ONEPKG reader

tests/fixtures/README.md

@@ -0,0 +1,64 @@
+# Fixture provenance
+
+No private notebook may be committed. Each binary fixture requires a public,
+reviewed source, an immutable revision, a redistribution licence, a content
+expectation, and a retained hash. Base64 encoding is only a repository transport
+and does not change the underlying file's licence.
+
+## `onenote_desktop.one.b64`
+
+- Source: Joplin
+  [`packages/app-cli/tests/support/onenote/onenote_desktop.one`](https://github.com/laurent22/joplin/blob/28eb53bd9f0cd4ae0dec0c59a08037075a38302b/packages/app-cli/tests/support/onenote/onenote_desktop.one),
+  introduced at commit
+  [`28eb53bd9f0cd4ae0dec0c59a08037075a38302b`](https://github.com/laurent22/joplin/commit/28eb53bd9f0cd4ae0dec0c59a08037075a38302b).
+- Licence: AGPL-3.0-or-later; full text in `LICENSES/AGPL-3.0.txt`.
+- Decoded size: 34,904 bytes.
+- Decoded SHA-256:
+  `7c43e85e2169b4bc3236db73a24c8f20d5c284b74563c07baf1406887d20eb5e`.
+- Golden expectation: desktop OneStore section with three pages — `Test`,
+  `Another page`, and `Page 3` — plus readable text/timestamps and diagnostics
+  for image, table, and ink content.
+
+## `joplin-test.onepkg.base64`
+
+- Source: Joplin
+  [`packages/app-cli/tests/support/onenote/test.onepkg`](https://github.com/laurent22/joplin/blob/1e73aad7eb08fde5d9e4cb533df40052a5cd32d7/packages/app-cli/tests/support/onenote/test.onepkg)
+  at commit `1e73aad7eb08fde5d9e4cb533df40052a5cd32d7`, introduced by
+  [Joplin PR #14094](https://github.com/laurent22/joplin/pull/14094).
+- Licence: AGPL-3.0-or-later; full text in `LICENSES/AGPL-3.0.txt`.
+- Decoded size: 11,066 bytes.
+- Decoded SHA-256:
+  `83cb622d40f0ab127038b629553b6926be3e2a6ce642f169df0e2614c13e8469`.
+- CAB expectation: one LZX `0x1203` folder, three CFDATA blocks, seven UTF-8
+  and nested paths, five `.one` sections, and two `.onetoc2` entries.
+- Parser expectation: all five sections parse, producing seven pages in total:
+  `Page 1`, `Page 2`, `Test`, `Test page`, `Testing…`, `A test`, and
+  `Tuesday, January 13, 2026`.
+
+Tests verify the package hash, all seven paths, the native `.one` magic for
+every section, section parse statuses, and representative title/text output.
+
+## Inline rust-cab CAB fixtures
+
+`src/onenote/onepkg/cabinet.test.ts` contains byte-for-byte test arrays copied
+from rust-cab `src/cabinet.rs` at commit
+[`c5839f5fdfa4c4e7cc9b22f570c79c96af0560e2`](https://github.com/mdsteele/rust-cab/tree/c5839f5fdfa4c4e7cc9b22f570c79c96af0560e2).
+They are MIT-licensed; the exact upstream text is in
+`LICENSES/rust-cab-MIT.txt`.
+
+The arrays cover an uncompressed single-entry CAB, an uncompressed two-entry
+CAB, and an LZX `0x1303` CAB containing `hi.txt` and `bye.txt`. They are CAB
+unit fixtures, not OneNote exports, and are not evidence of `.onepkg` producer
+compatibility.
+
+## Distribution policy
+
+The decoded fixture bytes are used only by tests. Vite does not copy them into
+`dist`, and the release packager does not add them to the application ZIP. The
+release may include this provenance document and licence text so its notices
+remain complete.
+
+A copied upstream fixture needs an individual licence and redistribution
+review; a repository-level licence must not be assumed to cover every binary.
+Generated fixtures must document the generator command/input and must not be
+described as real application exports.