chore: align IaC with today's package installs + PDF comparison docs

DevOps sync (2026-05-21):
- Remove onlyoffice-desktopeditors from absent list (actively used)
- Add gnome-keyring, rbw to common role (secrets migration)
- Add perl-image-exiftool, icoutils, innoextract-git to dev-tools
  (Windows installer inspection)
- Create fonts role: Inter, Cascadia Code, Fira, Source Sans, TeX Gyre
- Create pdf role: zathura, zathura-pdf-mupdf, python-weasyprint
- Register new roles in workstation.yml

PDF comparison:
- Add pdf-comparison docs with Quarto/Typst/Pandoc outputs
- Add batch-pdf.sh script
- Update yazi-cheatsheet.md
- Ignore .quarto/ cache

ansible/roles/common/tasks/main.yml

@@ -225,4 +225,14 @@
   shell: echo 30 > /sys/module/zswap/parameters/max_pool_percent
   become: yes
   changed_when: false
-  tags: [optimization, zswap]
+  tags: [optimization, zswap]
+
+- name: Ensure secrets management tools are installed
+  community.general.pacman:
+    name:
+      # Secrets bridge (KWallet migration)
+      - gnome-keyring
+      # Bitwarden CLI client
+      - rbw
+    state: present
+  tags: [secrets, bitwarden]

ansible/roles/dev-tools/tasks/main.yml

@@ -51,6 +51,10 @@
       - wp-cli
       # C/C++ toolchain (cpp skill)
       - clang
+      # Windows installer inspection (amicron-version-inspection skill)
+      - perl-image-exiftool
+      - icoutils
+      - innoextract-git
       # CalDAV tools (caldav-webcal skill)
       - khal
       - vdirsyncer
@@ -93,7 +97,6 @@
       - bleachbit
       - reiserfsprogs
       - dmraid
-      - onlyoffice-desktopeditors
       - virt-manager
       - guvcview
       - helvum

ansible/roles/fonts/tasks/main.yml

@@ -0,0 +1,17 @@
+---
+- name: Ensure workstation fonts are installed
+  community.general.pacman:
+    name:
+      # Primary UI font (Inter brand font)
+      - inter-font
+      # Code editor fonts
+      - otf-cascadia-code
+      - ttf-fira-code
+      - otf-fira-mono
+      # Sans-serif families
+      - otf-fira-sans
+      - adobe-source-sans-fonts
+      # Serif fallback
+      - tex-gyre-fonts
+    state: present
+  tags: [fonts, typography]

ansible/roles/pdf/tasks/main.yml

@@ -0,0 +1,11 @@
+---
+- name: Ensure PDF viewer and generation tools are installed
+  community.general.pacman:
+    name:
+      # Minimal PDF viewer (Wayland-compatible)
+      - zathura
+      - zathura-pdf-mupdf
+      # PDF generation from HTML/CSS
+      - python-weasyprint
+    state: present
+  tags: [pdf, viewer, generation]