refactor: replace pdf-sign with libpdf/core for PDF operations (#2403)

Migrate from @documenso/pdf-sign and @cantoo/pdf-lib to @libpdf/core
for all PDF manipulation and signing operations. This includes:

- New signing transports for Google Cloud KMS and local certificates
- Consolidated PDF operations using libpdf API
- Added TSA (timestamp authority) helper for digital signatures
- Removed deprecated flatten and insert utilities
- Updated tests to use new PDF library

render.yaml

@@ -117,6 +117,18 @@ services:
         sync: false
       - key: NEXT_PRIVATE_SIGNING_GCLOUD_APPLICATION_CREDENTIALS_CONTENTS
         sync: false
+      - key: NEXT_PRIVATE_SIGNING_GCLOUD_HSM_CERT_CHAIN_FILE_PATH
+        sync: false
+      - key: NEXT_PRIVATE_SIGNING_GCLOUD_HSM_CERT_CHAIN_CONTENTS
+        sync: false
+      - key: NEXT_PRIVATE_SIGNING_GCLOUD_HSM_SECRET_MANAGER_CERT_PATH
+        sync: false
+      - key: NEXT_PRIVATE_SIGNING_TIMESTAMP_AUTHORITY
+        sync: false
+      - key: NEXT_PUBLIC_SIGNING_CONTACT_INFO
+        sync: false
+      - key: NEXT_PRIVATE_USE_LEGACY_SIGNING_SUBFILTER
+        sync: false
 
       # SMTP Optional
       - key: NEXT_PRIVATE_SMTP_APIKEY_USER