fix: WASM CDN defaults bypass Docker empty env vars, nginx redirect port issue

- Fix envOrDefault() to treat empty strings as unset, so Docker builds
  without WASM build args correctly fall through to hardcoded CDN defaults
- Show CDN defaults as placeholder text in WASM settings page instead of
  filling input values, with "Pre-configured" status badge
- Fix nginx redirecting locale URLs without trailing slash (e.g. /de) to
  internal port 8080 by adding absolute_redirect off
- Handle encrypted PDF error in compress tool with descriptive message
- Replace Docker Hub pulls badge with GHCR downloads badge

src/js/logic/compress-pdf-page.ts

@@ -121,6 +121,15 @@ async function performCondenseCompression(
       return { ...result, usedFallback: true };
     }
 
+    if (
+      errorMessage.includes('closed or encrypted') ||
+      errorMessage.includes('encrypted')
+    ) {
+      throw new Error(
+        'This PDF is encrypted or password-protected. Please remove the password first using the Unlock PDF tool, then try compressing again.'
+      );
+    }
+
     throw new Error(`PDF compression failed: ${errorMessage}`);
   }
 }