Add PDF document service with AI extraction and per-app settings

- New `features/doc-service` FastAPI microservice: PDF upload, async
  text extraction (pdfplumber), AI classification via Anthropic/Ollama/
  LM Studio, per-user categories, file download
- Alembic migration isolated with `alembic_version_doc_service` table
- Main backend: httpx proxy routers for /api/documents/* and
  /api/documents/categories/*, admin settings API at /api/settings/*
- Runtime config in /config/doc_service_config.json (shared Docker
  volume); api_key masking on reads; atomic write with os.replace()
- Frontend: DocumentsPage, DocumentAdminSettingsPage, updated AppsPage
  launcher hub, simplified Nav (removed Settings link), new routes
- docker-compose: doc-service service, doc_data + app_config volumes,
  removed internal:true from backend-net for outbound AI API calls
- Fix pre-commit hook: probe Docker socket path so git subprocess picks
  up Docker Desktop on macOS
- Fix security_check.py: use sys.executable for bandit so venv python
  is used instead of system python

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

features/doc-service/app/schemas/category.py

@@ -0,0 +1,20 @@
+from datetime import datetime
+
+from pydantic import BaseModel
+
+
+class CategoryOut(BaseModel):
+    id: str
+    user_id: str
+    name: str
+    created_at: datetime
+
+    model_config = {"from_attributes": True}
+
+
+class CategoryCreate(BaseModel):
+    name: str
+
+
+class CategoryUpdate(BaseModel):
+    name: str

features/doc-service/app/schemas/document.py

@@ -0,0 +1,39 @@
+from datetime import datetime
+
+from pydantic import BaseModel
+
+
+class CategoryOut(BaseModel):
+    id: str
+    name: str
+    model_config = {"from_attributes": True}
+
+
+class DocumentOut(BaseModel):
+    id: str
+    user_id: str
+    filename: str
+    file_size: int
+    status: str
+    document_type: str | None
+    extracted_data: str | None  # JSON string — frontend calls JSON.parse()
+    tags: str | None            # JSON array string
+    error_message: str | None
+    created_at: datetime
+    processed_at: datetime | None
+    categories: list[CategoryOut] = []
+
+    model_config = {"from_attributes": True}
+
+
+class DocumentStatusOut(BaseModel):
+    id: str
+    status: str
+    error_message: str | None
+    processed_at: datetime | None
+
+    model_config = {"from_attributes": True}
+
+
+class DocumentTypeUpdate(BaseModel):
+    document_type: str