Add generic plugin architecture and watch-directory feature

Introduces a manifest contract so feature containers self-describe their
settings (JSON Schema + access rules). Backend and frontend gain generic
plugin proxy and dynamic Extensions UI with zero feature-specific code.

Doc-service is the first plugin consumer: exposes /plugin/manifest and
/plugin/settings, adds a watchdog-based file watcher that auto-ingests
PDFs from a mounted directory, maps subfolders to categories, supports
AI-suggested folder/filename (user-confirmed), and enforces a no-remove
policy. Access is gated by is_superuser or doc-service-admin group.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/STATUS.md

@@ -23,6 +23,7 @@ All API calls go through `src/api/client.ts` (single Axios instance, JWT injecte
 | `/admin/groups` | `AdminGroupsPage` | Admin only |
 | `/profile` | `ProfilePage` | Required |
 | `/settings` | `SettingsPage` (placeholder) | Required |
+| `/settings/plugins/:id` | `PluginSettingsPage` | Required (per-plugin access control) |
 
 `PrivateRoute` redirects to `/login` when no token. `AdminRoute` redirects to `/` when not admin.
 
@@ -60,6 +61,12 @@ Cards are rendered dynamically from `GET /api/services` (polled every 30 s via T
 - Sections auto-open when navigating to their route
 - In collapsed (icons-only) mode, clicking the Apps icon navigates to `/apps`
 
+**Extensions** section (dynamic):
+- Populated from `GET /api/plugins` (polled via TanStack Query, `retry: false`)
+- Only shown when the user has access to at least one plugin
+- Each entry links to `/settings/plugins/:id`
+- No code changes needed to add future plugin-enabled feature containers
+
 ### Documents page (`/apps/documents`)
 
 **Upload:** PDF file input, 202 response, error display.
@@ -140,6 +147,10 @@ Key functions:
 | `removeCategory(docId, catId)` | Remove |
 | `updateDocumentTags(id, tags)` | `PATCH /documents/{id}/tags` |
 | `updateDocumentTitle(id, title)` | `PATCH /documents/{id}/title` |
+| `confirmFolderSuggestion(docId)` | `POST /documents/{id}/suggestions/folder/confirm` |
+| `rejectFolderSuggestion(docId)` | `POST /documents/{id}/suggestions/folder/reject` |
+| `confirmFilenameSuggestion(docId)` | `POST /documents/{id}/suggestions/filename/confirm` |
+| `rejectFilenameSuggestion(docId)` | `POST /documents/{id}/suggestions/filename/reject` |
 | `getAISettings()` | `GET /settings/ai` (masked) |
 | `updateAISettings(data)` | `PATCH /settings/ai` |
 | `testAIConnection()` | `POST /settings/ai/test` |
@@ -152,6 +163,10 @@ Key functions:
 | `adminAddGroupMember(gId, uId)` | `POST /admin/groups/{gId}/members/{uId}` |
 | `adminRemoveGroupMember(gId, uId)` | `DELETE /admin/groups/{gId}/members/{uId}` |
 | `updateDocumentLimits(data)` | `PATCH /settings/documents/limits` |
+| `getPlugins()` | `GET /plugins` — list accessible plugins |
+| `getPluginManifest(id)` | `GET /plugins/{id}/manifest` |
+| `getPluginSettings(id)` | `GET /plugins/{id}/settings` |
+| `updatePluginSettings(id, data)` | `PATCH /plugins/{id}/settings` |
 
 ---
 
@@ -168,8 +183,10 @@ Key functions:
 | Component | Path | Description |
 |-----------|------|-------------|
 | `AppShell` | `src/components/AppShell.tsx` | Layout wrapper: Sidebar + scrollable main content |
-| `Sidebar` | `src/components/Sidebar.tsx` | Collapsible left nav (icons-only ↔ icons+labels) |
+| `Sidebar` | `src/components/Sidebar.tsx` | Collapsible left nav; includes dynamic "Extensions" section |
 | `ThemeToggle` | `src/components/ThemeToggle.tsx` | Sun/moon ghost icon button; persists to localStorage |
+| `PluginSchemaForm` | `src/components/PluginSchemaForm.tsx` | JSON Schema → React form (boolean/string/number/readOnly fields) |
+| `PluginSettingsPage` | `src/pages/PluginSettingsPage.tsx` | Generic plugin settings page (manifest-driven) |
 | `Button` | `src/components/ui/button.tsx` | shadcn/ui Button (default, ghost, outline, destructive) |
 | `Input` | `src/components/ui/input.tsx` | shadcn/ui Input |
 
@@ -188,10 +205,11 @@ Key functions:
 - [x] UI component library: shadcn/ui + Tailwind CSS — installed and wired up
 - [x] AppShell + Sidebar replacing inline Nav component
 - [x] Light/dark theme context with OS preference detection
+- [x] Generic plugin infrastructure: Extensions sidebar section, PluginSchemaForm, PluginSettingsPage
+- [ ] Suggestion badges in DocumentsPage for `suggested_folder` / `suggested_filename` (confirm/reject buttons)
 - [ ] Toast notification system (upload success, save feedback, errors)
 - [ ] Loading skeletons
 - [ ] `POST /queue/jobs` integration — show AI processing queue status / progress per document
-- [ ] Re-process document button (`POST /documents/{id}/reprocess` — needs backend endpoint first)
 - [ ] Advanced filter: extracted data fields (vendor, due date, amount) — needs backend support
 - [x] Groups admin UI — list, create, edit, delete, add/remove members
 - [ ] App permissions UI per group (blocked on backend group_app_permissions)