I don't know the full limitations of using a browser's built-in PDF viewer. I think the browser's Content Security Policy is part of it (you can read more about that as it relates to PDFs in this post). There have been a number of requests to improve the PDF viewer though and I'll try and pass features along here if and when they're included.
Unfortunately, for now, viewing the PDF in a separate window or using a 3rd party API (which is indeed a lot of boilerplate) might be the best way to go.
The app should work on Cloud with retool-edge.com as the allowed domain as long as you've added the Adobe Embed API:
The app wasn't set to reload the custom component automatically when entering the API key, I edit the post so the attached json does so. That may have been the issue but if not I can take a closer look with you if you'd like!