Ticket 4 — Inline PDF show for allowed protected/fiscal media

[jbagsik]

What to build

When show/preview is allowed, an admin can view an application/pdf inline in the Media admin (authorized URL / iframe), instead of only seeing a PDF icon. Spatie PDF→image conversion may still provide thumbnails; it is not the document-of-record viewer. When show is denied, inline PDF is not offered.

Acceptance criteria

• PDF with show allowed: inline viewer available in admin.
• PDF with show denied: no inline viewer.
• Viewer uses authorized access for private-disk files (no permanent public URL requirement).
• Thumbnail/conversion behaviour is not confused with the inline document viewer in docs.
• Test covers show allow vs deny for PDF preview availability.