Kullapan/api-s3 — reverse-engineered prompt

Build me a secure API service for finding and downloading agent report PDFs from S3. It should not use a database. It should look inside an S3 bucket folder, find reports by agent code, optional unit code, optional report code, and date range, then return the newest reports first with offset and limit paging.

I also need a download endpoint that streams the PDF straight from S3 to the user without loading the whole file into memory. Please validate all inputs so unsafe paths like dots, slashes, or backslashes are rejected with a clear error.

Use Kotlin with Spring Boot and a reactive approach. Include local development with Docker and LocalStack so I can run everything on my machine and test against fake S3 data. Add sample HTTP requests, config for local and production S3 settings, solid unit tests with coverage, and a Dockerfile. Also include OpenShift deployment files so it can be deployed later. Look up current docs online if you need to.