Recreates the click path of the real link: pd(event) → data-click dispatcher →
doAttachmentSingleClick → checkTokenAndDownloadAttachment →
checkStorageAuthAndExecute → Z → C/n. The PDF loads into an
<iframe id="ATTACHMENT-DATA"> exactly like production.
The sample PDF is encrypted — the browser's native PDF viewer will prompt for a password.
The password is test.