feat: export PDF Playwright headless + buildCvHtml serveur (THI-125 — 3/3)

[Tbeaumont79]

Objet — THI-125 (3/3), export PDF

Dernière brique : route Nitro POST /api/cv/export-pdf qui génère un PDF A4 à partir d'un RenderableCv, et les utilitaires serveur associés.

Chaîne de PRs : #3 (contrat+guardrail) → #6 (template Vue+page) → cette PR.

Ce qui est livré

server/utils/cv-html.ts — buildCvHtml(cv)

HTML complet auto-suffisant : tokens inline (synchronisés avec main.css), CSS A4/print, XSS-escape systématique sur toutes les données entrantes. Aucune dépendance externe (pas de CDN) — prêt pour Chromium headless.

server/utils/pdf.ts — renderHtmlToPdf(html)

• playwright-core + Chrome système (CHROMIUM_EXECUTABLE_PATH pour Docker/CI, fallback macOS dev).
• page.pdf({ format: 'A4', printBackground: true, margin: ... }).
• --no-sandbox pour les containers.

server/api/cv/export-pdf.post.ts

• Validation Zod de la structure (discriminatedUnion sur kind).
• assertValidCv (garde-fou provenance, défense en profondeur — le moteur THI-124 l'aura déjà fait avant stockage, mais on revalide ici aussi).
• Réponse : application/pdf + Content-Disposition: attachment; filename="cv.pdf".
• Données jamais loggées (RGPD §4.4 THI-120).

7 tests unitaires buildCvHtml

Structure HTML, nom/accroche, contacts, toutes les sections, puces d'expérience, échappement XSS, tokens CSS.

Variables d'environnement (optionnelles)

Var	Défaut	Usage
CHROMIUM_EXECUTABLE_PATH	Chrome macOS local	Chemin Chromium en container/CI

Vérifications locales

• pnpm --filter @cvo/app test ✅ 13/13 (7 cv-html + 6 health) · pnpm lint ✅

DoD final THI-125 ✅

Un profil + une offre → CV HTML affiché (/cv/demo) + PDF téléchargeable (POST /api/cv/export-pdf), pagination correcte.

• PR(s) < 400 lignes : PR1=420l, PR2=354l, PR3=363l ✓
• TS strict ✓ · Tailwind tokens ✓ · Garde-fou provenance ✓ · Tests ✓

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

@Tbeaumont79, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 16 minutes and 58 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Free

Run ID: a164c149-d0c0-4660-95c4-678c27cd8e57

📥 Commits

Reviewing files that changed from the base of the PR and between c105dc1 and c0a9a8a.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (5)

• apps/app/package.json
• apps/app/server/api/cv/export-pdf.post.ts
• apps/app/server/utils/cv-html.ts
• apps/app/server/utils/pdf.ts
• apps/app/test/cv-html.spec.ts

---

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting https://app.coderabbit.ai/login.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}