Add generic plugin architecture and watch-directory feature

Introduces a manifest contract so feature containers self-describe their
settings (JSON Schema + access rules). Backend and frontend gain generic
plugin proxy and dynamic Extensions UI with zero feature-specific code.

Doc-service is the first plugin consumer: exposes /plugin/manifest and
/plugin/settings, adds a watchdog-based file watcher that auto-ingests
PDFs from a mounted directory, maps subfolders to categories, supports
AI-suggested folder/filename (user-confirmed), and enforces a no-remove
policy. Access is gated by is_superuser or doc-service-admin group.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

features/doc-service/app/services/config_reader.py

@@ -14,6 +14,14 @@ from pathlib import Path
 
 from app.core.config import settings
 
+_DEFAULT_STORAGE_CONFIG: dict = {
+    "watch_enabled": False,
+    "watch_path": "/data/watch",
+    "ai_folder_suggestion": False,
+    "ai_folder_default": "imports",
+    "ai_rename_suggestion": False,
+}
+
 _DEFAULT_SYSTEM_PROMPT = (
     "You are a financial document analysis assistant. "
     "Given the text extracted from a PDF document, return ONLY a JSON object "
@@ -43,6 +51,7 @@ _DEFAULT_USER_TEMPLATE = (
 
 _DEFAULT_CONFIG: dict = {
     "documents": {"max_pdf_bytes": 20 * 1024 * 1024},
+    "storage": _DEFAULT_STORAGE_CONFIG,
     "system_prompts": {
         "system": _DEFAULT_SYSTEM_PROMPT,
         "user_template": _DEFAULT_USER_TEMPLATE,
@@ -64,6 +73,25 @@ def _read_config_sync() -> dict:
     return _apply_env_overrides(base)
 
 
+def _read_config_sync_raw() -> dict:
+    """Read without env overrides — used when we need to write back to disk."""
+    path = Path(settings.CONFIG_PATH)
+    if not path.exists():
+        return deepcopy(_DEFAULT_CONFIG)
+    with open(path) as f:
+        return json.load(f)
+
+
+def _write_config_sync(config: dict) -> None:
+    """Atomically write config JSON to disk."""
+    path = Path(settings.CONFIG_PATH)
+    tmp = path.with_suffix(".tmp")
+    tmp.parent.mkdir(parents=True, exist_ok=True)
+    with open(tmp, "w") as f:
+        json.dump(config, f, indent=2)
+    os.replace(tmp, path)
+
+
 def _apply_env_overrides(config: dict) -> dict:
     cfg = deepcopy(config)
     docs = cfg.setdefault("documents", {})
@@ -84,3 +112,22 @@ async def load_doc_config() -> dict:
     _cache = data
     _cache_at = now
     return data
+
+
+async def get_storage_config() -> dict:
+    """Return storage config block, filling in defaults for any missing keys."""
+    config = await load_doc_config()
+    result = deepcopy(_DEFAULT_STORAGE_CONFIG)
+    result.update(config.get("storage", {}))
+    return result
+
+
+async def save_storage_config(data: dict) -> None:
+    """Merge data into the storage config block and persist to disk."""
+    global _cache, _cache_at
+    raw = await asyncio.to_thread(_read_config_sync_raw)
+    raw.setdefault("storage", {}).update(data)
+    await asyncio.to_thread(_write_config_sync, raw)
+    # Invalidate cache so next read picks up the new values
+    _cache = None
+    _cache_at = 0.0