fix(documents): read Papra as it answers

Papra organization ids are checked against org_ plus 24 characters
before anything is sent. A 403 user.not_in_organization and a 400
server.invalid_request.params read as no such organization instead of a
refused key; the error body is read for its code and never passed on.
The connection test also reads the tags, so a key without tags:read
fails at save (permissionMissing) instead of on the first filter. Name
searches quote each word, so a leading dash is not a negation, and the
date range goes to Papra as date:>= / date:<= with the per-row check
kept as a net.

src/lib/openapi/error-codes.ts

@@ -145,6 +145,7 @@ export const ERROR_CODE_CATALOGUE: Readonly<Record<string, readonly string[]>> =
       "documents.sources.notFound",
       "documents.sources.organizationRequired",
       "documents.sources.originNotAllowed",
+      "documents.sources.permissionMissing",
       "documents.sources.rateLimited",
       "documents.sources.redirected",
       "documents.sources.tokenRequired",