Add generic plugin architecture and watch-directory feature

Introduces a manifest contract so feature containers self-describe their
settings (JSON Schema + access rules). Backend and frontend gain generic
plugin proxy and dynamic Extensions UI with zero feature-specific code.

Doc-service is the first plugin consumer: exposes /plugin/manifest and
/plugin/settings, adds a watchdog-based file watcher that auto-ingests
PDFs from a mounted directory, maps subfolders to categories, supports
AI-suggested folder/filename (user-confirmed), and enforces a no-remove
policy. Access is gated by is_superuser or doc-service-admin group.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

features/doc-service/alembic/versions/0003_add_watch_columns.py

@@ -0,0 +1,30 @@
+"""add watch directory columns to documents
+
+Revision ID: 0003
+Revises: 0002
+Create Date: 2026-04-18
+
+"""
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+
+revision: str = "0003"
+down_revision: Union[str, None] = "0002"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.add_column("documents", sa.Column("source", sa.String(16), nullable=False, server_default="upload"))
+    op.add_column("documents", sa.Column("watch_path", sa.String(), nullable=True))
+    op.add_column("documents", sa.Column("suggested_folder", sa.String(128), nullable=True))
+    op.add_column("documents", sa.Column("suggested_filename", sa.String(500), nullable=True))
+
+
+def downgrade() -> None:
+    op.drop_column("documents", "suggested_filename")
+    op.drop_column("documents", "suggested_folder")
+    op.drop_column("documents", "watch_path")
+    op.drop_column("documents", "source")