Handle password-protected and corrupted PDFs gracefully

[kovtcharov]

Problem

`src/gaia/rag/sdk.py:413-578` — no detection of encrypted/password-protected PDFs. Encrypted PDFs extract empty text but report success:

reader = PdfReader(pdf_path)       # Succeeds even if encrypted
for i, page in enumerate(reader.pages):
    pypdf_text = page.extract_text()  # Returns empty string for encrypted pages

User sees the document as "indexed" with 0 chunks and gets no results on queries.

Impact

• Encrypted PDFs silently produce empty indices
• Corrupted PDFs crash with unhelpful exceptions
• User doesn't know their PDF wasn't actually readable
• Error message ("No text content found") is misleading for encrypted files

Proposed Fix

1. Check `reader.is_encrypted` before processing — raise specific error
2. Catch `PdfReadError` for corrupted PDFs with user-friendly message
3. Return specific error codes: `encrypted`, `corrupted`, `empty`, `unsupported`
4. Provide remediation guidance: "Remove PDF password using qpdf or pdftk"
5. Handle partially readable PDFs (some pages encrypted, some not)
6. Add `pdf_status` to metadata: `readable`, `partial`, `encrypted`, `corrupted`

Files

• src/gaia/rag/sdk.py (lines 413-578, _extract_text_from_pdf)

Acceptance Criteria

• Encrypted PDFs return clear "password protected" error
• Corrupted PDFs return clear "corrupted file" error
• User gets actionable guidance for each error type
• Unit tests with encrypted and corrupted PDF fixtures

[kovtcharov]

Status: Partially Fixed

What works now:

• Corrupted PDFs are handled gracefully — generic except Exception at sdk.py:634 catches corruption errors, logs them, and re-raises. The document indexing error handler catches this and reports a user-facing error. No crashes.
• Password-protected PDFs also don't crash — PdfReader() raises an exception that's caught by the same handler.

What's still missing:

1. No explicit password-protected detection — the code doesn't distinguish between a corrupted PDF and a password-protected one. The error message at line 1942 mentions password protection as a possibility, but the code never actually checks for it (e.g., via reader.is_encrypted).
2. Generic error message — user sees a vague "Failed to process document" instead of a specific "This PDF is password-protected. Please provide the password or use an unprotected version."
3. No password input option — PyPDF2/pypdf supports reader.decrypt(password), but there's no UI or API flow to accept a password from the user.

Remaining work to fully close:

• Detect reader.is_encrypted before extraction and return a specific error
• Improve user-facing error message to distinguish password-protected from corrupted
• (Nice to have) Add password input flow in Agent UI