feat: add agent-pdf skill and API (#26)

## Background

Add `agent-pdf/` - a lightweight Rust microservice that lets AI agents
edit and fill PDFs through SimplePDF. Hosted at `agent.simplepdf.com`.

## Changes

- Add Rust API service (`GET /?url=` for URL passthrough, `POST /` for
file upload and JSON URL)
- `GET /` without params serves `SKILL.md` as `text/markdown` for agent
discovery
- `?companyIdentifier` routes to custom SimplePDF portals
- Default editor host: `ai.simplepdf.com`
- S3-compatible storage for file uploads (1hr expiry)
- Proxy-aware rate limiting with bounded bucket eviction
- Input validation (subdomain pattern, URL scheme) and HTML escaping in
snippets
- Dockerfile for DO App Platform deployment
- GitHub Actions CI workflow (fmt, clippy, build)

## Notes

Companion PR on simple-pdf:
SimplePDF/simple-pdf#157 (plan + submodule ref)

Author: bendersej

.github/workflows/agents.yaml

@@ -0,0 +1,50 @@
+name: Agents
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - agents/**
+      - .github/workflows/agents.yaml
+  pull_request:
+    branches:
+      - main
+    paths:
+      - agents/**
+      - .github/workflows/agents.yaml
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: agents
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+
+      - name: Cache cargo
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            agents/target
+          key: ${{ runner.os }}-cargo-${{ hashFiles('agents/Cargo.lock') }}
+          restore-keys: ${{ runner.os }}-cargo-
+
+      - name: Format
+        run: cargo fmt --check
+
+      - name: Clippy
+        run: cargo clippy -- -D warnings
+
+      - name: Build
+        run: cargo build

agents/.do/app.yaml

@@ -0,0 +1,40 @@
+name: agent-pdf
+region: nyc
+services:
+  - name: api
+    github:
+      repo: SimplePDF/simplepdf-embed
+      branch: main
+      deploy_on_push: true
+    source_dir: agents
+    dockerfile_path: Dockerfile
+    instance_count: 1
+    instance_size_slug: basic-xs
+    http_port: 8080
+    health_check:
+      http_path: /health
+    envs:
+      - key: S3_KEY
+        scope: RUN_TIME
+        type: SECRET
+      - key: S3_SECRET
+        scope: RUN_TIME
+        type: SECRET
+      - key: S3_ENDPOINT
+        scope: RUN_TIME
+        value: https://nyc3.digitaloceanspaces.com
+      - key: S3_BUCKET
+        scope: RUN_TIME
+        value: agent-pdf
+      - key: S3_REGION
+        scope: RUN_TIME
+        value: nyc3
+      - key: DEFAULT_EDITOR_HOST
+        scope: RUN_TIME
+        value: ai.simplepdf.com
+      - key: TRUSTED_IP_HEADER
+        scope: RUN_TIME
+        value: do-connecting-ip
+      - key: RATE_LIMIT_PER_MIN
+        scope: RUN_TIME
+        value: "30"

agents/.gitignore

@@ -0,0 +1 @@
+/target