Company search: surface ceased PSCs/resigned officers + view filing documents

Two owner-reported company-search defects.

Defect 1 (frontend only, CompanyPanel - backs both the assistant side
panel and the /company-search tabs): the PSC renderer never read
`ceased_on`, so ceased PSCs displayed as current; resigned officers only
had inline text. Both now carry a neutral grey "Ceased"/"Resigned" pill
(shared Badge) + DD/MM/YYYY date, a de-emphasised row, active-first stable
ordering, and a muted "· N ceased/resigned" count in the section header.

Defect 2: filing-history rows had no way to open the underlying document.
New backend proxy GET /companies/:companyNumber/filing-history/
:transactionId/document walks the CH Document API chain (transaction →
document_metadata → signed content URL), streaming the PDF inline with a
25 MB guard and a host-check (SSRF defence) on the upstream-supplied URLs;
the key is dropped on the cross-origin 302 to S3 and never logged. Route
uses the sibling try/catch + companiesHouseErrorResponse/logAndRespond
pattern (guarantees a response with fixed safe details - the guarantee the
asyncHandler rule exists to provide). Frontend gains a per-item "View PDF"
affordance (blob → new tab, busy + inline-error states). Chat tool
description now tells the model to flag resigned/ceased status explicitly.

Tests: +6 lib (metadata→content helper: happy chain, 404 no-metadata,
404 no-content-link, oversize reject, off-host SSRF reject, empty-key
401) and +6 route (validateTransactionId + document route over a real
server with the CH client mocked). Backend 385/385 green; tsc + eslint
clean. No new deps, no migrations. UI screenshots pending (headless).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>