refactor(payments): generate SSPD downloads with local signing ## Changes Taxpayers requested an optional SSPD download alongside existing bank/payment receipts. Add `Unduh SSPD` to settled, submitted SPTPD summaries and receipt views across dashboard, taxpayer, government collector and representative contexts. The dedicated A4 SSPD form follows the supplied reference, with no Lembar or receiving-office signature cell. It shows taxpayer identity/address, NOPD and object address, Kode Rek Pajak, Metode Pembayaran, and Uraian Pembayaran containing actual active Kode Bayar, NTB, QRIS ID, VA, bank/channel and transaction references when recorded. Masa Pajak and Tahun Pajak share one wide cell. Nomor Ketetapan appears only for actual assessment references, including SKPD, SKPDKB, SPPT and SKPDKBT. The amount includes terbilang, and the Wajib Pajak/Penyetor area spans the full row. Additional objects and references use attachments. Every page retains RAHASIA. Opening or reloading an SSPD requests an unsigned preview. Only clicking `Unduh SSPD` generates fresh locally signed bytes, rechecks authorization and the authoritative source snapshot, then downloads that response. SSPD bypasses all cloud cache reads, uploads, receipt writes and bucket checks. The application cannot download the preview Blob through its SSPD controls. Its QR checks current payment status without a stored signature ID; the certificate signature is checked in a PDF reader. Bank and electronic payment receipts remain documents that are dipersamakan dengan SSPD. Existing SPTPD, Kode Bayar and Bukti Bayar signing/storage behavior remains unchanged. Closes #1777 ## Release impact Patch. This extends the existing payment receipt and SPTPD document-download workflow with an optional SSPD form and download-time local signing. ## Migration notes No schema migration or new dependency. SSPD download uses the existing local organization certificate path/passphrase and requires no signing bucket. Unsigned SSPD preview needs no certificate. Missing or invalid signing credentials prevent a signed download without falling back to unsigned bytes. Previously stored artifacts remain untouched; new SSPD requests never consult or write cloud artifacts. The printed taxpayer name identifies the payment subject and does not assert personal-certificate signing or taxpayer declaration consent. ## Validation - Focused TypeScript check for the changed SSPD API, data, service, renderer and UI modules passed using a 3 GiB heap. The earlier repository-wide check exhausted 4 GiB and was not repeated. - React Doctor changed audit against base `d1d0f42ca563b4f38c98a553a227e08bcfdad39e` and full audit passed with 0 errors, 0 warnings and complete coverage. The full audit verifies the exact new server-only renderer boundary and reviewed configuration checksum. - UI policy syntax checks, Drizzle query policy against the same base, focused ESLint and `git diff --check` passed. The Drizzle audit reported 0 violations and 0 exceptions. - Rendered and visually inspected QRIS, VA/assessment, credit-only and seven-page combined examples, including attachments and long period text. - Added regression coverage for transient issuance, no cloud accesses, fresh signing per download, unsigned previews, payment/assessment projection, permission/source rechecks and signed-download controls. Tests were not run. - No local build or dev server was run. Live certificate signing and authenticated browser interaction were not exercised. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **New Features** * Added downloadable SSPD payment evidence, with an in-app PDF preview and a signed document available for eligible settled payments. * SSPD PDFs include payment, taxpayer, and assessment details, with verification information and attachments for longer documents. * Added clearer document titles and seal descriptions for public PDFs. * **Bug Fixes** * Restricted SSPD download options to eligible paid, non-draft reports. * Improved handling of failed, outdated, or unsigned SSPD download requests. <!-- end of auto-generated comment: release notes by coderabbit.ai -->