[backportbot-libresign]

Backport of #9104 for Nextcloud 34. Fixes #9103.

The automated cherry-pick included Nextcloud 36 Viewer code that cannot run on this stable branch. The follow-up commits adapt it to the supported API:

• Use OCA.Viewer.openWith('pdf', ...) for authenticated users when the native PDF handler is registered.
• Open signed documents through /apps/libresign/p/pdf/{uuid} without passing the original file ID to any Viewer/Office handler.
• Use the direct URL fallback for anonymous visitors or when the native PDF handler is unavailable. Do not silently swallow Viewer errors.
• Keep ordinary document opening unchanged.
• Remove accidental lockfile changes, NC36-only test mocks, and unrelated async caller changes introduced by the automatic backport.
• Keep validation component regression tests and a Playwright scenario for the anonymous PDF fallback.

Local validation

• 83 focused Vitest tests passed (Viewer + validation components)
• TypeScript (npm run ts:check)
• JavaScript build (npm run build)
• Playwright test discovery
• Focused ESLint: existing ESLint 8/flat-config mismatch on this stable branch; GitHub check must be evaluated separately
• Review current GitHub Actions results (Playwright workflow only targets main)

Historical backport blockers

• The original contributor commit has mismatched author/sign-off names (Frost-Phoenix vs oPeras1). Its DCO check remains unresolved; the six manually added commits across all backports are individually signed and DCO-valid.
• This bot-created backport also contains one empty historical commit.
• No existing commits were rewritten or squashed. Resolve historical DCO separately before merging.