fix: correct initial zoom label (150%), disable download btns until first compile

fix: replace iframe with PDF.js canvas rendering — bypasses all HuggingFace sandbox restrictions

fix: serve PDF via stable server URL to bypass HuggingFace sandbox restrictions

fix: use object tag instead of iframe for PDF preview (fixes HuggingFace blob URL restriction)

initial version