security: replace public PDF URLs with authenticated API route, private bucket

shop/app/order/success/page.tsx

@@ -7,7 +7,6 @@ import { Card, CardContent, CardHeader, CardTitle } from '@/components/ui/card'
 import { Separator } from '@/components/ui/separator'
 import { Badge } from '@/components/ui/badge'
 import type { Order } from '@/lib/types'
-import { resolveSupabaseUrl } from '@/lib/utils'
 
 export default async function OrderSuccessPage({
   searchParams,
@@ -223,12 +222,12 @@ export default async function OrderSuccessPage({
             {o.pdf_url && (
               <div className="flex gap-2 pt-2">
                 <Button variant="outline" size="sm" asChild className="border-white/10 hover:bg-white/10">
-                  <a href={resolveSupabaseUrl(o.pdf_url)} target="_blank" rel="noopener noreferrer">
+                  <a href={`/api/orders/${o.id}/download?inline=true`} target="_blank" rel="noopener noreferrer">
                     <ExternalLink className="w-4 h-4 mr-2" /> Anfragebestätigung ansehen
                   </a>
                 </Button>
                 <Button variant="secondary" size="sm" asChild>
-                  <a href={resolveSupabaseUrl(o.pdf_url)} download>
+                  <a href={`/api/orders/${o.id}/download`} download>
                     <Download className="w-4 h-4 mr-2" /> Herunterladen
                   </a>
                 </Button>