fix(security): enforce audited account, network and resource boundaries

Implement B01-B06 with regression coverage and retained validation evidence. Preserve the production ingress preflight; F04 runtime verification remains open.

job-tracker-ui/src/cv-builder-page.test.tsx

@@ -53,6 +53,20 @@ beforeEach(() => {
 
 afterEach(() => window.localStorage.removeItem('uiLanguage'));
 
+test.each([
+  [503, 'PDF generation is busy. Please try again shortly.'],
+  [504, 'PDF generation took too long. Please try again.'],
+])('PDF status %s shows an actionable message without retrying', async (status, message) => {
+  mockedApi.get.mockResolvedValueOnce({ data: [{ id: 1, name: 'Synthetic CV', themeId: 'modern', version: 1, updatedAtUtc: new Date().toISOString() }] } as any);
+  mockedApi.post.mockRejectedValueOnce({ response: { status, data: new Blob(['{}'], { type: 'application/problem+json' }) } });
+  renderPage();
+  await screen.findByText('Synthetic CV');
+  fireEvent.click(screen.getByRole('button', { name: 'Actions for Synthetic CV' }));
+  fireEvent.click(await screen.findByRole('menuitem', { name: 'Download PDF' }));
+  expect(await screen.findByText(message)).toBeInTheDocument();
+  expect(mockedApi.post).toHaveBeenCalledTimes(1);
+});
+
 test('lists existing CVs from the variants API', async () => {
   mockedApi.get.mockResolvedValueOnce({
     data: [