Add PDF generation pipeline via browserless and Defuddle

Connects to browserless over CDP (playwright-core), extracts article
content with Defuddle/JSDOM, renders it through buildCleanHtml, and
prints a PDF on a second page. Adds an in-browser request filter as a
second line of SSRF defense against redirects to private/localhost
hosts, on top of assertPublicUrl's DNS check.

Integration test is gated by RUN_PDF_INTEGRATION=1 (describe.runIf) so
it is skipped in a normal npm run test and only runs against a real
browserless instance.

src/lib/clean-pdf/__tests__/generate.int.test.ts

@@ -0,0 +1,17 @@
+import { describe, expect, it } from "vitest";
+import { generateCleanPdf } from "@/lib/clean-pdf/generate";
+
+const enabled = process.env.RUN_PDF_INTEGRATION === "1";
+
+describe.runIf(enabled)("generateCleanPdf (integration, нужен browserless)", () => {
+  it("генерирует PDF реальной статьи", async () => {
+    const { pdf, title } = await generateCleanPdf({
+      url: "https://habr.com/ru/articles/942236/",
+      format: "A4",
+      theme: "light",
+    });
+    expect(pdf.length).toBeGreaterThan(20_000);
+    expect(pdf.subarray(0, 5).toString()).toBe("%PDF-");
+    expect(title.length).toBeGreaterThan(3);
+  }, 120_000);
+});