fix(api): handle encrypted PDFs in NDA PDF processing

apps/api/src/trust-portal/nda-pdf.service.ts

@@ -1,5 +1,11 @@
 import { Injectable, Logger } from '@nestjs/common';
-import { PDFDocument, rgb, StandardFonts, degrees } from 'pdf-lib';
+import {
+  PDFDocument,
+  rgb,
+  StandardFonts,
+  degrees,
+  EncryptedPDFError,
+} from 'pdf-lib';
 import { AttachmentsService } from '../attachments/attachments.service';
 
 @Injectable()
@@ -242,7 +248,23 @@ By signing below, the Receiving Party agrees to be bound by the terms of this Ag
     },
   ): Promise<Buffer> {
     const { name, email, docId, watermarkText } = params;
-    const pdfDoc = await PDFDocument.load(pdfBuffer);
+
+    let pdfDoc: PDFDocument;
+    try {
+      pdfDoc = await PDFDocument.load(pdfBuffer);
+    } catch (error) {
+      if (error instanceof EncryptedPDFError) {
+        // Encrypted PDF - return as-is without watermark
+        // User already signed NDA for accountability, encrypted PDFs require password anyway
+        this.logger.debug(
+          `Skipping watermark for PDF ${docId} - file is encrypted`,
+        );
+        return pdfBuffer;
+      }
+      // Re-throw other parsing errors
+      throw error;
+    }
+
     await this.addWatermark(pdfDoc, name, email, docId, watermarkText);
     const pdfBytes = await pdfDoc.save();
     return Buffer.from(pdfBytes);