fix(document): localize loadDocument error too — no raw pdf.js text

The render path was localized but loadDocument still stored the raw
pdf.js message (and an untranslated English fallback), contradicting the
"never leak raw error text" principle. Both load and render failures now
set the localized doc_render_failed message.

Addresses re-review: Felix, Nora (raw error leak on the load path).

Refs #708

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/lib/document/viewer/usePdfRenderer.svelte.test.ts

@@ -277,7 +277,7 @@ describe('createPdfRenderer', () => {
 		expect(r.error).toBeNull();
 	});
 
-	it('loadDocument sets error and loading=false when getDocument().promise rejects', async () => {
+	it('loadDocument sets a localized error (not the raw pdf.js message) when getDocument rejects', async () => {
 		const failingLib = {
 			GlobalWorkerOptions: { workerSrc: '' },
 			getDocument: vi.fn().mockReturnValue({
@@ -294,6 +294,7 @@ describe('createPdfRenderer', () => {
 		await r.init();
 		await r.loadDocument('/bad/path');
 		expect(r.loading).toBe(false);
-		expect(r.error).toBe('PDF not found');
+		expect(r.error).toBe(m.doc_render_failed());
+		expect(r.error).not.toContain('PDF not found');
 	});
 });