docs: organize tool pages by modality under /tools/<modality>/

Move all 157 tool pages into image/video/audio/pdf/data subfolders so URLs read /tools/<modality>/<id> (e.g. /tools/image/crop). Nest the image sub-categories under an Image group in the sidebar so the nav reads by modality. Add public/_redirects (301, clean + .html forms) mapping every old flat /tools/<id> URL to its new path so inbound links keep working. Rewrite all internal /tools links. Verified with a clean docs build (no dead links).

apps/docs/tools/pdf/protect-pdf.md

@@ -0,0 +1,47 @@
+---
+description: Add password protection with AES-256 encryption to a PDF.
+---
+
+# Protect PDF
+
+Add password protection to a PDF using AES-256 encryption.
+
+## API Endpoint
+
+`POST /api/v1/tools/pdf/protect-pdf`
+
+Accepts multipart form data with a PDF file and a JSON `settings` field.
+
+## Parameters
+
+| Parameter | Type | Required | Default | Description |
+|-----------|------|----------|---------|-------------|
+| userPassword | string | Yes | - | Password required to open the PDF (1-256 characters) |
+| ownerPassword | string | No | Same as `userPassword` | Owner password for permissions (1-256 characters) |
+
+## Example Request
+
+```bash
+curl -X POST http://localhost:1349/api/v1/tools/pdf/protect-pdf \
+  -H "Authorization: Bearer si_your-api-key" \
+  -F "file=@document.pdf" \
+  -F 'settings={"userPassword": "s3cret", "ownerPassword": "0wn3r"}'
+```
+
+## Example Response
+
+```json
+{
+  "jobId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
+  "downloadUrl": "/api/v1/download/a1b2c3d4-e5f6-7890-abcd-ef1234567890/document.pdf",
+  "originalSize": 2450000,
+  "processedSize": 2500000
+}
+```
+
+## Notes
+
+- Encryption uses AES-256.
+- If `ownerPassword` is omitted, it defaults to the same value as `userPassword`.
+- Passwords are redacted from audit logs.
+- The encrypted PDF requires the user password to open and the owner password (if different) for full permissions.