The signing tool keeps no signature on the device (#1, bau-pm BAU-260)

PDF.js's signature dialog saved every signature in localStorage under
pdfjs.signature, "save" ticked on every open, for this origin rather
than for a bau-pm user. Measured on v0.1.0: a typed and an uploaded
signature were offered to a fresh page on the same browser, the way the
next person on a shared tablet would get it, a Redmine logout included.
Another browser profile saw nothing; the server never had anything.

The glue's fifth duty, in every window before PDF.js's modules: delete
the store (a device that saved signatures loses them on its first
visit), refuse writes to that key, hold the save box unticked through a
property on the element and hide it, and hide the dialog's Bild tab and
its file picker, so a scanned signature never enters the dialog.

test/signatures.mjs is the second gate, in CI and the release workflow:
a browser seeded with a real saved entry (captured from v0.1.0's own
store) is offered none, the dialog shows neither the box nor the tab, a
typed signature is placed and not stored, a fresh page is offered
nothing. Fed v0.1.0: 9 findings, exit 1. Against this image: 0, and the
zero-host gate drove 117 tool pages with nothing leaving the origin. A
signed PDF still exports with the signature on the page.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -37,7 +37,7 @@ jobs:
         timeout-minutes: 15
         run: docker build -f test/Dockerfile -t bau-pm-pdf-tools-gate:ci .
 
-      - name: gate - nothing leaves the origin
+      - name: gate - nothing leaves the origin, no signature is kept
         timeout-minutes: 40
         run: |
           net="bau-pm-pdf-tools-ci-${GITHUB_RUN_ID}"
@@ -50,3 +50,5 @@ jobs:
             sleep 2
           done
           docker run --rm --network "$net" bau-pm-pdf-tools-gate:ci node test/zero-hosts.mjs http://pdf-tools:8080
+          # bau-pm §2.77: the signing tool keeps no signature on the device.
+          docker run --rm --network "$net" bau-pm-pdf-tools-gate:ci node test/signatures.mjs http://pdf-tools:8080

.gitea/workflows/release.yml

@@ -51,7 +51,7 @@ jobs:
           docker build --pull --build-arg VERSION="v$VERSION" \
             -t "$REGISTRY/$IMAGE:$VERSION" -t "$REGISTRY/$IMAGE:latest" .
 
-      - name: gate - nothing leaves the origin
+      - name: gate - nothing leaves the origin, no signature is kept
         timeout-minutes: 50
         run: |
           docker build -f test/Dockerfile -t bau-pm-pdf-tools-gate:release .
@@ -65,6 +65,8 @@ jobs:
             sleep 2
           done
           docker run --rm --network "$net" bau-pm-pdf-tools-gate:release node test/zero-hosts.mjs http://pdf-tools:8080
+          # bau-pm §2.77: the signing tool keeps no signature on the device.
+          docker run --rm --network "$net" bau-pm-pdf-tools-gate:release node test/signatures.mjs http://pdf-tools:8080
 
       - name: push
         run: |