feat: add PDF password protection

[Pawankumar3210]

Which issue does this close?

Closes #83

What changed

Added a new Protect PDF operation at src/operations/protect-pdf/.

The tool lets users select a PDF, enter and confirm a password, and download an encrypted PDF. It uses qpdf-run with locally bundled qpdf WebAssembly and runs entirely in the browser.

The implementation follows DoxDock's plugin pattern and reuses the shared Dropzone, Progress, Note, DownloadButton, and useJob components.

Acceptance criteria

• Encrypting with a password produces a PDF that requires that password to open.
• Wrong/empty password is handled with clear validation.
• Works fully offline with no external network requests during encryption.

Checklist

• Runs fully offline: no network calls, no CDNs, no external assets (strict CSP connect-src 'self').
• Follows the plugin pattern and reuses shared components where relevant.
• npm run build passes locally.

Proof

Tested the generated PDF with a real PDF reader using a real PDF file:

• Correct password → PDF opens successfully.
• Wrong password → PDF is rejected and does not open.
• Empty/mismatched password → Protect PDF action remains disabled.
• Playwright offline E2E → 2/2 tests passed.
• No external network requests detected during encryption.
• npm test → 40/40 tests passed.
• npm run build → passed.
• ESLint → passed.

[vercel]

@Pawankumar3210 is attempting to deploy a commit to the Mithun Srinivas' projects Team on Vercel.

A member of the Team first needs to authorize it.

[mithun-srinivas]

This is a big one @Pawankumar3210, thank you. Password-protecting a PDF fully in the browser is exactly the kind of thing most tools do server-side, and you did it right: qpdf compiled to WebAssembly with the worker and wasm served from our own origin, AES-256 encryption, no CDN. Loading the engine through new URL(..., import.meta.url) keeps it same-origin, and the zero-external-network E2E check proves it actually stays local while encrypting.

This closes the biggest gap we had, the whole Security category. Merging now since every check is green.

One tiny thing for a future pass, not blocking: a couple of the progress messages have a stray character where an ellipsis should be. Worth a quick tidy next time. Thanks for taking on a hard one!