Native-access via bootJar manifest, not CLI flags everywhere

JDK 22+ honors an 'Enable-Native-Access' attribute on the executable
jar's manifest (JEP 472). Setting it once on the Spring Boot bootJar
removes the need to remember --enable-native-access=ALL-UNNAMED in:
  - Docker init script's JAVA_BASE_OPTS injection
  - Tauri Rust launcher's java_options vector
  - Anywhere else somebody runs the bootJar
…and also future-proofs against JDK 26's hard-fail behavior without
each launch point having to track the flag.

app/core/build.gradle: add 'Enable-Native-Access': 'ALL-UNNAMED' to the
bootJar manifest attributes block.

build.gradle (bootRun jvmArgs): keep --enable-native-access=ALL-UNNAMED
because bootRun launches from classfiles, not the bootJar — the
manifest mechanism doesn't apply to that codepath, only to 'java -jar'.

scripts/init-without-ocr.sh: drop the FFM injection.
frontend/src-tauri/src/commands/backend.rs: drop the CLI arg.

scripts/init-without-ocr.sh

@@ -816,16 +816,6 @@ if [ "$AOT_ENABLED" = "true" ]; then
   fi
 fi
 
-# ---------- FFM Native Access ----------
-# JPDFium uses the Foreign Function & Memory API to call into PDFium.
-# JDK 25 warns when libraries call restricted methods without explicit
-# permission; JDK 26+ will refuse outright. ALL-UNNAMED because Stirling-PDF
-# runs as a Spring Boot fat jar on the classpath (not the module path).
-case "${JAVA_BASE_OPTS}" in
-  *enable-native-access*) ;;
-  *) JAVA_BASE_OPTS="${JAVA_BASE_OPTS} --enable-native-access=ALL-UNNAMED" ;;
-esac
-
 # Collapse duplicate whitespace
 JAVA_BASE_OPTS=$(echo "$JAVA_BASE_OPTS" | tr -s ' ')