fix(documents): read Papra as it answers

Papra organization ids are checked against org_ plus 24 characters
before anything is sent. A 403 user.not_in_organization and a 400
server.invalid_request.params read as no such organization instead of a
refused key; the error body is read for its code and never passed on.
The connection test also reads the tags, so a key without tags:read
fails at save (permissionMissing) instead of on the first filter. Name
searches quote each word, so a leading dash is not a negation, and the
date range goes to Papra as date:>= / date:<= with the per-row check
kept as a net.

src/lib/validations/document-sources.ts

@@ -10,7 +10,7 @@ import {
   DOCUMENT_PICKER_LINK_KINDS,
   DOCUMENT_PICKER_MAX_PAGE,
   DOCUMENT_PICKER_QUERY_MAX,
-  PAPRA_ID,
+  PAPRA_ORG_ID,
 } from "@/lib/documents/sources/types";
 import {
   documentSourceIdSchema,
@@ -38,7 +38,7 @@ export const documentSourceSaveSchema = z.object({
   organizationId: z
     .string()
     .trim()
-    .regex(PAPRA_ID, "Expected letters, digits, _ or -")
+    .regex(PAPRA_ORG_ID, "Expected a Papra organization id (org_…)")
     .optional(),
   token: z
     .string()