Add generic plugin architecture and watch-directory feature

Introduces a manifest contract so feature containers self-describe their
settings (JSON Schema + access rules). Backend and frontend gain generic
plugin proxy and dynamic Extensions UI with zero feature-specific code.

Doc-service is the first plugin consumer: exposes /plugin/manifest and
/plugin/settings, adds a watchdog-based file watcher that auto-ingests
PDFs from a mounted directory, maps subfolders to categories, supports
AI-suggested folder/filename (user-confirmed), and enforces a no-remove
policy. Access is gated by is_superuser or doc-service-admin group.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

features/doc-service/app/models/document.py

@@ -27,6 +27,12 @@ class Document(Base):
     )
     processed_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
 
+    # Watch-directory ingestion fields (migration 0003)
+    source: Mapped[str] = mapped_column(String(16), nullable=False, default="upload")
+    watch_path: Mapped[str | None] = mapped_column(String, nullable=True)
+    suggested_folder: Mapped[str | None] = mapped_column(String(128), nullable=True)
+    suggested_filename: Mapped[str | None] = mapped_column(String(500), nullable=True)
+
     category_assignments: Mapped[list["CategoryAssignment"]] = relationship(
         "CategoryAssignment", back_populates="document", cascade="all, delete-orphan"
     )