Implementace prevodu HTML na PDF

Sluzba prijme adresu HTML dokumentu nebo HTML v tele requestu a vrati PDF.
Navrzena pro dokumenty o stovkach az tisicich stranek.

Rendering:
- WeasyPrint jako vychozi engine, spravne CSS Paged Media, nizka pametova
  narocnost, bez JavaScriptu
- Chromium pres Playwright pro dokumenty dokreslovane skripty
- rezim auto s detekci skriptu a fallbackem pri selhani WeasyPrintu

Velke dokumenty:
- deleni na casti na strukturalnich hranicich, rez nikdy uvnitr tabulky
  nebo odstavce
- dvoupruchodovy render obsahu se skutecnymi cisly stranek, pozice nadpisu
  se ctou z kotev hlasenych u kazde stranky
- cislovani stranek bud pres CSS countery, nebo pres cislovaci vrstvu
  nastampovanou na hotove PDF, rozmer stranky se cte z vysledneho souboru
- Chromium se restartuje po N jobech, nikdy vsak behem beziciho renderu

API:
- POST /convert synchronne, POST /jobs asynchronne se sledovanim stavu,
  stahovanim vysledku, rusenim a volitelnym callbackem
- GET /health s overenim dostupnosti obou enginu a stavem fronty
- OpenAPI respektuje prefix reverse proxy pres root_path

Bezpecnost a provoz:
- SSRF kontrola po DNS resolvu, na kazdem presmerovani a u vsech pozadavku
  prohlizece
- nedostupne assety render nezastavi, ale hlasi se v odpovedi i v logu
- fronta s omezenym poctem workeru, rozpracovane joby se pri ukonceni
  oznaci jako failed, nezmizi potichu
- strukturovane JSON logovani s job_id
- vsechny limity vypnute ve vychozim stavu

Dockerfile je dvoufazovy, obsahuje zavislosti WeasyPrintu, Chromium
a fonty s ceskou diakritikou.

Autentizace zamerne neni implementovana, zpusob predavani neni domluveny.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/test_security.py

@@ -0,0 +1,65 @@
+"""SSRF protection.
+
+The important case is a public hostname that resolves to a loopback address.
+Checking the URL string alone would let it through.
+"""
+
+from __future__ import annotations
+
+import socket
+
+import pytest
+
+from app.config import Settings
+from app.errors import BlockedTargetError
+from app.services.security import UrlGuard
+
+
+@pytest.fixture
+def guard() -> UrlGuard:
+    return UrlGuard(Settings())
+
+
+def test_literal_loopback_is_blocked(guard: UrlGuard) -> None:
+    with pytest.raises(BlockedTargetError):
+        guard.check("http://127.0.0.1:8000/dokument.html")
+
+
+def test_private_range_is_blocked(guard: UrlGuard) -> None:
+    with pytest.raises(BlockedTargetError):
+        guard.check("http://192.168.1.10/dokument.html")
+
+
+def test_link_local_metadata_endpoint_is_blocked(guard: UrlGuard) -> None:
+    with pytest.raises(BlockedTargetError):
+        guard.check("http://169.254.169.254/latest/meta-data/")
+
+
+def test_hostname_resolving_to_loopback_is_blocked(guard: UrlGuard, monkeypatch) -> None:
+    def fake_getaddrinfo(host, *args, **kwargs):  # noqa: ARG001
+        return [(socket.AF_INET, socket.SOCK_STREAM, 6, "", ("127.0.0.1", 80))]
+
+    monkeypatch.setattr(socket, "getaddrinfo", fake_getaddrinfo)
+
+    with pytest.raises(BlockedTargetError):
+        guard.check("http://vlastni-domena.example.com/dokument.html")
+
+
+def test_file_scheme_is_blocked(guard: UrlGuard) -> None:
+    with pytest.raises(BlockedTargetError):
+        guard.check("file:///etc/passwd")
+
+
+def test_public_address_passes(guard: UrlGuard, monkeypatch) -> None:
+    def fake_getaddrinfo(host, *args, **kwargs):  # noqa: ARG001
+        return [(socket.AF_INET, socket.SOCK_STREAM, 6, "", ("93.184.216.34", 80))]
+
+    monkeypatch.setattr(socket, "getaddrinfo", fake_getaddrinfo)
+    assert guard.check("https://example.com/dokument.html") == "example.com"
+
+
+def test_allowlisted_host_skips_the_check() -> None:
+    settings = Settings()
+    object.__setattr__(settings, "ssrf_allowed_hosts", ["localhost"])
+    guard = UrlGuard(settings)
+    assert guard.check("http://localhost:9000/dokument.html") == "localhost"