security: replace public PDF URLs with authenticated API route, private bucket

shop/app/my-orders/page.tsx

@@ -6,7 +6,6 @@ import { Button } from '@/components/ui/button'
 import { Card, CardContent } from '@/components/ui/card'
 import { Badge } from '@/components/ui/badge'
 import type { Order } from '@/lib/types'
-import { resolveSupabaseUrl } from '@/lib/utils'
 
 const statusLabel: Record<string, string> = {
   pending: 'Eingegangen',
@@ -154,12 +153,12 @@ export default async function MyOrdersPage() {
                     {o.pdf_url && (
                       <>
                         <Button variant="ghost" size="sm" asChild className="text-xs text-slate-400 hover:text-white">
-                          <a href={resolveSupabaseUrl(o.pdf_url)} target="_blank" rel="noopener noreferrer">
+                          <a href={`/api/orders/${o.id}/download?inline=true`} target="_blank" rel="noopener noreferrer">
                             <ExternalLink className="w-3 h-3 mr-1" /> Anfrage ansehen
                           </a>
                         </Button>
                         <Button variant="ghost" size="sm" asChild className="text-xs text-slate-400 hover:text-white">
-                          <a href={resolveSupabaseUrl(o.pdf_url)} download>
+                          <a href={`/api/orders/${o.id}/download`} download>
                             <Download className="w-3 h-3 mr-1" /> PDF
                           </a>
                         </Button>