fix: make /api/pdf serve from SFTP with timeout

backend/api.py

@@ -2,6 +2,8 @@ from __future__ import annotations
 
 import json
 import os
+import concurrent.futures
+
 from pathlib import Path
 from typing import Any, Dict
 
@@ -104,14 +106,25 @@ def root() -> Dict[str, str]:
 
 @app.get("/api/pdf/{pdf_id}")
 def get_pdf(pdf_id: str):
-    # Read PDF bytes from SFTP: /inserio/pdfs/{pdf_id}.pdf
-    rel = f"pdfs/{pdf_id}.pdf"
-    try:
-        data = download_bytes(rel)
-    except FileNotFoundError:
-        raise HTTPException(status_code=404, detail="pdf not found")
-    except Exception as e:
-        raise HTTPException(status_code=500, detail=f"sftp read failed: {e}")
+    # Read from SFTP path: /inserio/pdfs/<pdf_id>.pdf (SFTP_ROOT handles /inserio)
+    name = pdf_id
+    if not name.lower().endswith(".pdf"):
+        remote_path = f"pdfs/{name}.pdf"
+    else:
+        remote_path = f"pdfs/{name}"
+
+    # Hard timeout so requests never hang
+    with concurrent.futures.ThreadPoolExecutor(max_workers=1) as ex:
+        fut = ex.submit(download_bytes, remote_path)
+        try:
+            data = fut.result(timeout=10)
+        except concurrent.futures.TimeoutError:
+            from fastapi import HTTPException
+            raise HTTPException(status_code=504, detail="SFTP timeout reading PDF")
+
+    # Return raw bytes
+    from fastapi.responses import Response
+    return Response(content=data, media_type="application/pdf")
 
     # Stream bytes back to UI
     resp = PlainTextResponse(content=data)