fix: replace iframe with PDF.js canvas rendering — bypasses all HuggingFace sandbox restrictions

fix: serve PDF via stable server URL to bypass HuggingFace sandbox restrictions

fix: use object tag instead of iframe for PDF preview (fixes HuggingFace blob URL restriction)

initial version