Protected Document Viewer

Ingest a PDF from S3, then read it as rendered pages with a separate accessible text layer. The source file never reaches the browser.

file:///… also works when the backend is started with PDFDRM_ALLOW_LOCAL_INGEST=true, which is how the compose setup runs.