Thêm CI: build Windows portable tự động (GitHub Actions)

.github/workflows/build-windows.yml chạy trên windows-latest:
- Fetch pdfium.dll + qpdf.exe (script sẵn có scripts/fetch-*.ps1)
- cargo build --release cho app Tauri (không cần WiX/NSIS vì đóng gói
  portable thủ công, không dùng bundler cài đặt)
- Gộp FoFreeXit.exe + pdfium.dll + qpdf.exe (+ dll phụ thuộc) + hướng dẫn
  vào 1 thư mục, nén FoFreeXit-portable-win64.zip
- Đăng làm workflow artifact (mọi lần chạy) + GitHub Release (khi trigger
  thủ công workflow_dispatch) — người dùng tải trực tiếp từ GitHub, không
  cần cài Rust/Visual Studio/Node để build hay chạy thử

scripts/portable-readme.txt: hướng dẫn chạy bằng tiếng Việt kèm trong zip,
ghi rõ OCR/LibreOffice là tuỳ chọn cài thêm (app vẫn chạy đủ tính năng
Viewer/Annotate/Organize/Edit/Bảo mật/Form không cần chúng).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HgnbPwSoRGNH7LHsDUmRpk

.github/workflows/build-windows.yml

@@ -0,0 +1,79 @@
+name: Build Windows portable
+
+on:
+  workflow_dispatch: {}
+  push:
+    branches: [main]
+    paths:
+      - "app/**"
+      - "crates/**"
+      - "Cargo.lock"
+      - "scripts/fetch-pdfium.ps1"
+      - "scripts/fetch-qpdf.ps1"
+      - ".github/workflows/build-windows.yml"
+
+permissions:
+  contents: write
+
+jobs:
+  build:
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache cargo
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            app/src-tauri/target
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+
+      - name: Fetch PDFium (Windows x64)
+        shell: pwsh
+        run: powershell -ExecutionPolicy Bypass -File scripts/fetch-pdfium.ps1
+
+      - name: Fetch QPDF (Windows x64)
+        shell: pwsh
+        run: powershell -ExecutionPolicy Bypass -File scripts/fetch-qpdf.ps1
+
+      - name: Build release
+        working-directory: app/src-tauri
+        run: cargo build --release
+
+      - name: Assemble portable folder
+        shell: pwsh
+        run: |
+          $dist = "dist/FoFreeXit"
+          New-Item -ItemType Directory -Force -Path $dist | Out-Null
+          Copy-Item "app/src-tauri/target/release/fofreexit-app.exe" "$dist/FoFreeXit.exe"
+          Copy-Item "pdfium.dll" "$dist/pdfium.dll"
+          Copy-Item "qpdf/bin/*.exe" "$dist/"
+          Copy-Item "qpdf/bin/*.dll" "$dist/"
+          Copy-Item "scripts/portable-readme.txt" "$dist/DOC-doc-truoc-khi-chay.txt"
+          Compress-Archive -Path "$dist/*" -DestinationPath "FoFreeXit-portable-win64.zip" -Force
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: FoFreeXit-portable-win64
+          path: FoFreeXit-portable-win64.zip
+          retention-days: 30
+
+      - name: Publish GitHub Release
+        if: github.event_name == 'workflow_dispatch'
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: win-build-${{ github.run_number }}
+          name: "FoFreeXit Windows portable (build ${{ github.run_number }})"
+          body: |
+            Ban build Windows portable tu dong (khong can cai Rust/Visual Studio).
+            Giai nen `FoFreeXit-portable-win64.zip` roi chay `FoFreeXit.exe`.
+            Commit: ${{ github.sha }}
+          files: FoFreeXit-portable-win64.zip
+          prerelease: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

scripts/portable-readme.txt

@@ -0,0 +1,26 @@
+FoFreeXit - ban Windows portable (khong can cai dat)
+======================================================
+
+Cach chay:
+1. Giai nen toan bo file zip nay ra 1 thu muc (giu nguyen ca thu muc, DUNG
+   chi lay rieng file .exe ra ngoai - no can pdfium.dll va qpdf.exe canh no).
+2. Bam dup vao FoFreeXit.exe.
+3. Windows co the hien canh bao "Windows protected your PC" (SmartScreen) vi
+   file chua duoc ky so thuong mai - bam "More info" -> "Run anyway".
+
+Da co san (khong can cai):
+- pdfium.dll  (render/doc PDF - PDFium, cung engine loi cua Chrome)
+- qpdf.exe    (sua file hong, ma hoa/giai ma AES-256)
+
+Can Windows 10/11 co san WebView2 Runtime (da co san tren hau het may Windows
+10/11 cap nhat; neu chua co, Windows se tu goi y cai tu Microsoft).
+
+Tinh nang can cai them RIENG (khong bat buoc de dung app):
+- OCR (nhan dang chu trong file scan): can cai Tesseract OCR (ban UB
+  Mannheim, tick them goi ngon ngu "Vietnamese") - xem docs/20 trong repo.
+- Xuat/nhap Word chat luong cao & Office->PDF: can cai LibreOffice - xem
+  docs/19 trong repo. Khong co LibreOffice thi Xuat Word van chay duoc bang
+  bo chuyen co ban (van du dung).
+
+Day la ban build tu dong tu GitHub Actions, phuc vu MUC DICH DUNG THU/KIEM
+TRA. Xem tien do du an tai README.md va thu muc docs/ trong repo.