Download trigger — Server response with Content-Disposition: attachment

Click a button: JavaScript navigates to the file URL. The download is forced by the server response header Content-Disposition: attachment — not by the page.

S3 hosting note: a static object only sends this header if its metadata is set. Upload the target file with --content-disposition "attachment; filename=PDF.pdf" (see README), or point CLEAN/EICAR below at an object that already carries the header. Without it the PDF opens inline instead of downloading.

ready.