Add generic plugin architecture and watch-directory feature

Introduces a manifest contract so feature containers self-describe their
settings (JSON Schema + access rules). Backend and frontend gain generic
plugin proxy and dynamic Extensions UI with zero feature-specific code.

Doc-service is the first plugin consumer: exposes /plugin/manifest and
/plugin/settings, adds a watchdog-based file watcher that auto-ingests
PDFs from a mounted directory, maps subfolders to categories, supports
AI-suggested folder/filename (user-confirmed), and enforces a no-remove
policy. Access is gated by is_superuser or doc-service-admin group.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

features/doc-service/app/schemas/document.py

@@ -23,6 +23,10 @@ class DocumentOut(BaseModel):
     created_at: datetime
     processed_at: datetime | None
     categories: list[CategoryOut] = []
+    source: str = "upload"
+    watch_path: str | None = None
+    suggested_folder: str | None = None
+    suggested_filename: str | None = None
 
     model_config = {"from_attributes": True}