fix(documents): read Papra as it answers

Papra organization ids are checked against org_ plus 24 characters
before anything is sent. A 403 user.not_in_organization and a 400
server.invalid_request.params read as no such organization instead of a
refused key; the error body is read for its code and never passed on.
The connection test also reads the tags, so a key without tags:read
fails at save (permissionMissing) instead of on the first filter. Name
searches quote each word, so a leading dash is not a negation, and the
date range goes to Papra as date:>= / date:<= with the per-row check
kept as a net.

src/components/documents/sources/source-errors.ts

@@ -22,6 +22,7 @@ export function isStoppingError(code: string | undefined): boolean {
     code === "documents.inbound.rateLimited" ||
     code === "documents.inbound.quotaExceeded" ||
     code === "documents.sources.authRefused" ||
+    code === "documents.sources.permissionMissing" ||
     code === "documents.sources.unreachable" ||
     code === "documents.sources.originNotAllowed" ||
     code === "documents.sources.notConnected" ||
@@ -45,6 +46,8 @@ export function sourceErrorMessage(t: T, code: string | undefined): string {
       return t("documents.sourcePicker.errors.redirected");
     case "documents.sources.authRefused":
       return t("documents.sourcePicker.errors.authRefused");
+    case "documents.sources.permissionMissing":
+      return t("documents.sourcePicker.errors.permissionMissing");
     case "documents.sources.versionTooOld":
       return t("documents.sourcePicker.errors.versionTooOld");
     case "documents.sources.badResponse":