feat: fill in and sign PDFs you received, with found places, stamps and Next

[FPurchess]

Fill in and sign PDFs you received. Stacked on #123 (feat/pdf-tab).

What users get

• Found places:
  • Blank shows a PDF's form fields and unsigned signature fields on its pages.
  • On PDFs without a form, it finds the lines where a signature, a date or a place goes, from their labels in German and English: "Unterschrift Mieter", "Ort, Datum", "Signature", … Precision and recall are 1.0 on the 15 fixtures.
  • Next (bindable as pdf.next) goes through them in reading order. Enter or a click fills one. Places can be dismissed.
• Fields:
  • Text fields are typed in on the page, prefilled with your name, the date and the place.
  • Checkboxes, radio buttons and choices work too. Locked or blocked fields show disabled, with their reason.
  • A character the field's font can't show is named above the field.
• Stamps: the signing toolbar has Signature · Initials · Date · Place, then Sign….
  • Place a stamp with a click on a page, or from the keyboard at a default spot.
  • Move it with the arrows (Shift for 10 pt) or by mouse. Resize it with Alt+arrows or its handles. Delete removes it.
  • Initials can repeat on every page.
  • Undo and redo cover stamps, fills and dismissed places, and say what they changed.
• Sign… (Ctrl+S in a PDF tab) uses the same Sign dialog as exports. It writes "‹name› signed.pdf" and opens it.
  • The fills are MuPDF's revision, and the signature with the stamps is the next one.
  • The other signers get empty signature fields.
  • A PDF that is already signed takes only one more signature: tools that would change pages signed earlier are off, with the reason. A countersigned PDF says "Signed by 2".
  • A PDF that allows no changes turns everything off and says why.
• Closing a tab with stamps asks to sign first.

How it works

• Engine: each stamp is laid out by Blank's engine on a page that is the stamp's box (stampEngine.ts). Its one-page PDF becomes a Form XObject in the page or in the field's appearance. The wasm is rebuilt.
• Helper: new ops text, setFills and save, with the unused signatures op removed. Each answer is held to its own request's limit.
• Signer: update_pdf takes a plan of stamps, a signature spot and others. rules.rs reads DocMDP and FieldMDP locks. signing_sign_pdf takes a JSON header plus the stamps' PDFs.
• Webview:
  • places.ts / labels.ts find the places.
  • stampModel.ts holds the stamps, with one undo history of stamps, fills and dismissed places, kept under stamps:<id>.
  • The UI is SigningToolbar, StampOverlay, StampToolbar, PdfField, PdfTarget and PlaceDialog.
• Rules and docs: .claude/rules/pdf.md (with "Known limits") and signing.md, plus docs/guide/pdf.md, signing.md, the shortcuts and the FAQ.
• E2E: pdf.e2e.ts places, nudges and undoes a stamp, and signs form.pdf through Next, a typed signature and Sign….

Decisions to review

• The wording "This PDF is signed already, so it takes one more signature only", and "Without a digital signature, your signature would change pages the earlier signers signed. Sign with your certificate."
• A stamp leaves its place once its middle leaves the place's box.

Checked by hand

• Linux: placing, moving, filling, Next, signing unsigned, signed and form PDFs; a play-through by mouse and keyboard
• Radio buttons and list boxes in real-world forms; a certified (DocMDP P=1) PDF from Acrobat
• Shift+Tab on a real keyboard; a screen reader
• Acrobat shows the signed received PDF valid, with the other signers' fields signable