Add generic plugin architecture and watch-directory feature

Introduces a manifest contract so feature containers self-describe their
settings (JSON Schema + access rules). Backend and frontend gain generic
plugin proxy and dynamic Extensions UI with zero feature-specific code.

Doc-service is the first plugin consumer: exposes /plugin/manifest and
/plugin/settings, adds a watchdog-based file watcher that auto-ingests
PDFs from a mounted directory, maps subfolders to categories, supports
AI-suggested folder/filename (user-confirmed), and enforces a no-remove
policy. Access is gated by is_superuser or doc-service-admin group.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/deps.py

@@ -43,3 +43,44 @@ async def get_current_admin(
             detail="Not found",
         )
     return current_user
+
+
+async def check_plugin_access(
+    plugin_id: str,
+    current_user: User,
+    db: AsyncSession,
+) -> bool:
+    """
+    Return True if the user may access the given plugin's settings.
+
+    Access is granted when any of these conditions holds:
+      1. The user is a superuser AND the manifest allows superuser access.
+      2. The user is a member of one of the groups listed in manifest.access.required_groups.
+
+    Returns False (not raises) so callers can decide how to respond.
+    """
+    from app.models.group import Group, GroupMembership
+    from app.services.service_health import get_cached_manifest
+
+    manifest = get_cached_manifest(plugin_id)
+    if manifest is None:
+        return False
+
+    access = manifest.get("access", {})
+
+    if current_user.is_superuser and access.get("allow_superuser", True):
+        return True
+
+    for group_name in access.get("required_groups", []):
+        result = await db.execute(
+            select(GroupMembership)
+            .join(Group, Group.id == GroupMembership.group_id)
+            .where(
+                Group.name == group_name,
+                GroupMembership.user_id == current_user.id,
+            )
+        )
+        if result.scalar_one_or_none() is not None:
+            return True
+
+    return False