Implement secure content redaction with explicit verification

[McanKul]

Goal

Permanently remove sensitive content from selected page regions; a black rectangle alone is not redaction.

Scope

• Draw one or more redaction regions on selected pages.
• Remove or irreversibly rasterize underlying text, images and vector content inside each region.
• Add optional replacement fill and label such as REDACTED.
• Remove metadata and hidden text only through explicit user options.
• Warn when annotations, attachments or form values may still contain sensitive data.
• Produce a post-save verification report.

Acceptance criteria

• Redacted text cannot be selected, copied, searched or recovered from decoded content streams.
• Images beneath a redaction region do not retain recoverable hidden pixels in output objects.
• Verification scans output content/objects and fails closed if it cannot establish removal.
• Rotated and cropped pages map regions correctly.
• Original files are never overwritten.
• Tests include text, vector, image, OCR-layer, annotation and form-field fixtures.
• UI distinguishes permanent redaction from drawing a rectangle.

Design constraint

A rasterization-based MVP is acceptable if the UI clearly discloses the quality/accessibility tradeoff and only affected pages are rasterized.