fix(security): harden public CV edges

job-tracker-ui/src/components/JobDetailsDialog.tsx

@@ -1101,7 +1101,7 @@ export default function JobDetailsDialog({ open, jobId, onClose, initialTab = 0,
                       <Typography variant="overline">PDF-style preview</Typography>
                       <Typography variant="body2" sx={{ color: "text.secondary", mb: 1.5 }}>Preview and PDF export use the same HTML template contract. Accent color and photo settings apply here.</Typography>
                       {tailoredCvPreview ? (
-                        <iframe title="Tailored CV preview" srcDoc={tailoredCvPreview.html} style={{ width: "100%", minHeight: 780, border: "1px solid rgba(15,23,42,0.08)", borderRadius: 12, background: "white" }} />
+                        <iframe title="Tailored CV preview" srcDoc={tailoredCvPreview.html} sandbox="allow-same-origin" style={{ width: "100%", minHeight: 780, border: "1px solid rgba(15,23,42,0.08)", borderRadius: 12, background: "white" }} />
                       ) : (
                         <Typography sx={{ color: "text.secondary" }}>Build the PDF layout preview to inspect the ATS template before downloading.</Typography>
                       )}

job-tracker-ui/src/cv-builder-deep-link.test.tsx

@@ -224,5 +224,6 @@ test('preview failure is visible and retryable without leaving the editor', asyn
   expect(await screen.findByText('Preview unavailable')).toBeInTheDocument();
   fireEvent.click(screen.getByRole('button', { name: 'Retry preview' }));
   await waitFor(() => expect(screen.getByTitle('CV preview')).toHaveAttribute('srcdoc', '<p>retry</p>'));
+  expect(screen.getByTitle('CV preview')).toHaveAttribute('sandbox', 'allow-same-origin');
   await waitFor(() => expect(screen.queryByText('Preview unavailable')).not.toBeInTheDocument());
 });

job-tracker-ui/src/job-details-generated-drafts.test.tsx

@@ -229,7 +229,7 @@ test('template switching refreshes preview and export uses the selected template
     }));
   });
 
-  expect(await screen.findByTitle('Tailored CV preview')).toBeInTheDocument();
+  expect(await screen.findByTitle('Tailored CV preview')).toHaveAttribute('sandbox', 'allow-same-origin');
 
   const appendChildSpy = jest.spyOn(document.body, 'appendChild');
   const removeSpy = jest.spyOn(HTMLAnchorElement.prototype, 'remove').mockImplementation(() => {});

job-tracker-ui/src/views/CvBuilderEditor.tsx

@@ -408,6 +408,7 @@ export default function CvBuilderEditor() {
               ref={iframeRef}
               title="CV preview"
               srcDoc={html}
+              sandbox="allow-same-origin"
               onLoad={onIframeLoad}
               style={{
                 width: `${pageMetrics.widthMm}mm`, height: `${previewHeight}px`, border: "none",