feat(macos): PDF Services stamp helper with dual-channel Verae auth

Implements macOS v0: verae-print stamp + install-macos PDF menu items.
Saves {name}.pdf, {name}-verae-timestamp-{RECEIPTID}.pdf, and .verae.json.
Channels: verae (api.veraetime.net JWT) and zapier (zap.verae.ai xVerae- + attachPdf).

internal/job/job_test.go

@@ -0,0 +1,96 @@
+package job
+
+import (
+	"encoding/base64"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/VeraeLLC/PrintToVeraeTimeStamp/internal/auth"
+	"github.com/VeraeLLC/PrintToVeraeTimeStamp/internal/veraeapi"
+)
+
+func TestSanitizeAndStem(t *testing.T) {
+	if SanitizeReceiptID("bafy/xyz!") != "bafy-xyz" {
+		t.Fatal(SanitizeReceiptID("bafy/xyz!"))
+	}
+	if StemFromPath("/tmp/My Contract (1).pdf", "") != "My-Contract-1" {
+		t.Fatal(StemFromPath("/tmp/My Contract (1).pdf", ""))
+	}
+}
+
+func TestRunZapierWritesNamedFiles(t *testing.T) {
+	dir := t.TempDir()
+	src := filepath.Join(dir, "src.pdf")
+	if err := os.WriteFile(src, []byte("%PDF-1.4 hello"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	out := filepath.Join(dir, "out")
+	pdf := []byte("%PDF-1.4 certificate-bytes")
+	b64 := base64.StdEncoding.EncodeToString(pdf)
+
+	client := &veraeapi.Client{
+		Channel:     auth.ChannelZapier,
+		ZapierBase:  "https://zap.test",
+		XVeraeToken: "xVerae-x",
+		HTTPDo: func(req *http.Request) (*http.Response, error) {
+			body := `{"receipt_id":"bafyReceipt99","pdfBase64":"` + b64 + `"}`
+			return &http.Response{StatusCode: 200, Body: io.NopCloser(strings.NewReader(body)), Header: make(http.Header)}, nil
+		},
+	}
+
+	res, err := Run(Options{
+		SourcePDF:    src,
+		OutDir:       out,
+		DocumentName: "Contract.pdf",
+		Channel:      auth.ChannelZapier,
+		Client:       client,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	wantCert := filepath.Join(out, "Contract-verae-timestamp-bafyReceipt99.pdf")
+	if res.CertificatePDF != wantCert {
+		t.Fatalf("cert path %s want %s", res.CertificatePDF, wantCert)
+	}
+	if _, err := os.Stat(res.OriginalPDF); err != nil {
+		t.Fatal(err)
+	}
+	got, _ := os.ReadFile(res.CertificatePDF)
+	if string(got) != string(pdf) {
+		t.Fatalf("cert bytes mismatch")
+	}
+	if _, err := os.Stat(res.ReceiptJSON); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestRunVeraeRendersLocalCert(t *testing.T) {
+	dir := t.TempDir()
+	src := filepath.Join(dir, "memo.pdf")
+	_ = os.WriteFile(src, []byte("%PDF-1.4 memo"), 0o600)
+	out := filepath.Join(dir, "out")
+	client := &veraeapi.Client{
+		Channel:    auth.ChannelVerae,
+		VeraeBase:  "https://api.test",
+		VeraeToken: "jwt",
+		HTTPDo: func(req *http.Request) (*http.Response, error) {
+			body := `{"certificate":"cidLocal1","timestamp":"2026-10-03T12:00:00Z","existing":true}`
+			return &http.Response{StatusCode: 200, Body: io.NopCloser(strings.NewReader(body)), Header: make(http.Header)}, nil
+		},
+	}
+	res, err := Run(Options{SourcePDF: src, OutDir: out, Channel: auth.ChannelVerae, Client: client})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(res.CertificatePDF, "memo-verae-timestamp-cidLocal1.pdf") {
+		t.Fatal(res.CertificatePDF)
+	}
+	b, _ := os.ReadFile(res.CertificatePDF)
+	if !strings.HasPrefix(string(b), "%PDF") {
+		t.Fatal("not a pdf")
+	}
+}