ui: 5 polish fixes

fix: proxy PDFs through /api/pdf-proxy to bypass CORS

feat: add loading spinner and error fallback to PDF viewer

feat: on-demand document loading, no limit, PDF loading indicator

feat: human validation, recursive highlighting, data mentions rename