Add document viewer with proper 404 handling for trust center

Move document download/view to a dedicated viewer page with PDF preview,
access request flow, and a proper 404 error boundary when documents are
not found. The backend now returns NOT_FOUND instead of INTERNAL for
missing documents and reports.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/trust/document_service.go

@@ -90,6 +90,7 @@ func (s *DocumentService) ExportPDFWithoutWatermark(
 
 func (s DocumentService) Get(
 	ctx context.Context,
+	organizationID gid.GID,
 	documentID gid.GID,
 ) (*coredata.Document, error) {
 	document := &coredata.Document{}
@@ -110,6 +111,14 @@ func (s DocumentService) Get(
 		return nil, err
 	}
 
+	if document.OrganizationID != organizationID {
+		return nil, ErrDocumentNotFound
+	}
+
+	if document.TrustCenterVisibility == coredata.TrustCenterVisibilityNone {
+		return nil, ErrDocumentNotVisible
+	}
+
 	return document, nil
 }