fix: audit perbaikan NATS subject, worker spawn, frontend options, pipeline PDF output

Bug fixes:
1. NATS subject doubled prefix — gateway publish ke tools.tools.scan.*
   padahal workers subscribe ke tools.scan.*. Fix: pakai group() method
2. Worker subscriptions pake tokio::select! — cuma satu subscription
   yang diproses, sisanya di-cancel. Fix: ganti ke tokio::spawn + loop
3. WebSocket URL hardcoded ke localhost:3001 — gak jalan di prod.
   Fix: infer dari window.location atau env var
4. Frontend scan options hardcoded — user gak bisa atur OCR/enhance/format.
   Fix: interactive toggles, selects, slider
5. Frontend compress quality hardcoded — user gak bisa atur kualitas.
   Fix: quality range slider
6. Pipeline cuma output PNG — gak ada PDF/OCR.
   Fix: generate searchable PDF kalo tesseract feature enabled

Enhancements:
- Tool::group() method added — returns 'scan', 'image', 'pdf' dll
- Dockerfile: --features tesseract pas cargo build
- leptess OCR: proper API usage (set_image_from_mem, recognize, etc.)

Co-Authored-By: Kilo <kilo@kilo.ai>

frontend/src/hooks/use-job-status.ts

@@ -24,6 +24,7 @@ interface JobProgress {
 interface UseJobStatusOptions {
   onComplete?: (result: JobProgress["result"]) => void;
   onError?: (error: string) => void;
+  wsBaseUrl?: string; // optional override, e.g. "wss://tools.asepharyana.my.id"
 }
 
 export function useJobStatus(jobId: string | null, options?: UseJobStatusOptions) {
@@ -40,10 +41,13 @@ export function useJobStatus(jobId: string | null, options?: UseJobStatusOptions
   const connect = useCallback(() => {
     if (!jobId) return;
 
-    // Connect directly to Rust gateway WebSocket (not via Next.js)
-    const protocol = window.location.protocol === "https:" ? "wss:" : "ws:";
-    const host = "localhost:3001"; // Rust gateway - wss for production
-    const url = `${protocol}//${host}/api/job/${jobId}/ws`;
+    // Determine WS base URL: from options, NEXT_PUBLIC_WS_URL, or infer from page location
+    const wsBase = options?.wsBaseUrl
+      ?? process.env.NEXT_PUBLIC_WS_URL
+      ?? (typeof window !== "undefined"
+        ? `${window.location.protocol === "https:" ? "wss:" : "ws:"}//${window.location.host}`
+        : "ws://localhost:3002");
+    const url = `${wsBase}/api/job/${jobId}/ws`;
 
     const ws = new WebSocket(url);
     wsRef.current = ws;