fix(security): harden public CV edges

JobTrackerApi/Program.cs

@@ -454,7 +454,7 @@ builder.Services.AddRateLimiter(options =>
 
     options.AddPolicy("public-pdf", context =>
         RateLimitPartition.GetFixedWindowLimiter(
-            partitionKey: $"public-pdf:{context.Request.RouteValues["slug"]?.ToString() ?? "unknown"}",
+            partitionKey: RateLimitPartitionKeys.PublicPdf(context),
             factory: _ => new FixedWindowRateLimiterOptions
             {
                 PermitLimit = 3,

JobTrackerApi/Services/RateLimitPartitionKeys.cs

@@ -0,0 +1,13 @@
+using Microsoft.AspNetCore.Http;
+
+namespace JobTrackerApi.Services;
+
+public static class RateLimitPartitionKeys
+{
+    public static string PublicPdf(HttpContext context)
+    {
+        var client = context.Connection.RemoteIpAddress?.ToString() ?? "unknown";
+        var slug = context.Request.RouteValues["slug"]?.ToString() ?? "unknown";
+        return $"public-pdf:{client}:{slug}";
+    }
+}