perf(paste): skip the mode bundle on plaintext pastes, lazy-load the QR lib

[ClaraVnk]

Contexte

The paste page scored 87 with LCP at 4.0 s, shipping 515 KB — the same profile as the landing page fixed in #7, and arguably the more visited page.

Changements

The mode bundle is now conditional. codemirror-modes.min.js (~190 KB) loaded on every paste, including pastes with no language — which have no mode to apply — and languages that map to no CodeMirror mode at all, such as makefile. It now loads only when the paste actually has a mode. The remaining scripts pick up defer, which is safe because content is decrypted client-side after load, so no mode is needed at parse time.

The QR library is lazy. qrcode.min.js (21 KB) loaded on every paste for a modal most readers never open. It is now fetched on first click, carrying the same SRI hash it had as a static tag. The modal opens immediately and fills in when the lib lands; on failure it stays empty rather than blocking the reader.

Two dead files removed from static/, both referenced by nothing and both served publicly by the StaticFiles mount:

• highlight.min.js — 125 KB, superseded by CodeMirror.
• purify.min.js.sha256 — despite the name this is not a checksum. It is DOMPurify's source map ({"version":3,"file":"purify.min.js","sources":[...]}), 95 KB, exposing the full unminified source at a predictable URL. Worth a look at how it got committed under that name, in case the same slip affects a vendored file elsewhere.

Tests

Lighthouse mobile, median of 3 runs, same paste URL before and after:

paste type	score	LCP	weight
plaintext — before	87	4045 ms	515 KB
plaintext — after	95	2961 ms	307 KB
python — before	87	4076 ms	515 KB
python — after	88	3913 ms	495 KB

The plaintext case is where the win lands, which is the point: a python paste genuinely needs the bundle, a plaintext one never did.

Browser-verified on both paste types:

python   : decrypted=true highlighted=true (expected true)
python   : modes fetched=1 | qr lib before click=0 after click=1
python   : qr rendered=true | errors=none
plaintext: decrypted=true highlighted=false (expected false)
plaintext: modes fetched=0 | qr lib before click=0 after click=1
plaintext: qr rendered=true | errors=none

116 tests pass. One existing test caught the QR change and was updated rather than deleted — it now asserts the lib is not loaded eagerly and that the injected URL still carries SRI. One test added for the conditional mode bundle. ruff check / ruff format --check clean.

Risques

The conditional mode bundle is the change to review: if cm_mode_map ever gains an entry whose value is falsy for a language that does need highlighting, that paste silently renders unhighlighted. Today the map has exactly two such entries ("" and makefile), both correct, and the new test pins the behaviour at both ends.

Deleting purify.min.js.sha256 assumes nothing external links to it. It is unreferenced in this repo; if some deployment or doc points at it, that link breaks.