Add PDF document service with AI extraction and per-app settings

- New `features/doc-service` FastAPI microservice: PDF upload, async
  text extraction (pdfplumber), AI classification via Anthropic/Ollama/
  LM Studio, per-user categories, file download
- Alembic migration isolated with `alembic_version_doc_service` table
- Main backend: httpx proxy routers for /api/documents/* and
  /api/documents/categories/*, admin settings API at /api/settings/*
- Runtime config in /config/doc_service_config.json (shared Docker
  volume); api_key masking on reads; atomic write with os.replace()
- Frontend: DocumentsPage, DocumentAdminSettingsPage, updated AppsPage
  launcher hub, simplified Nav (removed Settings link), new routes
- docker-compose: doc-service service, doc_data + app_config volumes,
  removed internal:true from backend-net for outbound AI API calls
- Fix pre-commit hook: probe Docker socket path so git subprocess picks
  up Docker Desktop on macOS
- Fix security_check.py: use sys.executable for bandit so venv python
  is used instead of system python

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/api/client.ts

@@ -73,3 +73,113 @@ export const getProfile = () =>
 
 export const updateProfile = (data: ProfileUpdate) =>
   api.put<ProfileData>("/profile/me", data).then((r) => r.data);
+
+// --- Documents ---
+export type DocumentStatus = "pending" | "processing" | "done" | "failed";
+
+export interface CategoryOut {
+  id: string;
+  name: string;
+}
+
+export interface DocumentOut {
+  id: string;
+  user_id: string;
+  filename: string;
+  file_size: number;
+  status: DocumentStatus;
+  document_type: string | null;
+  extracted_data: string | null;
+  tags: string | null;
+  error_message: string | null;
+  created_at: string;
+  processed_at: string | null;
+  categories: CategoryOut[];
+}
+
+export interface DocumentStatusOut {
+  id: string;
+  status: DocumentStatus;
+  document_type: string | null;
+  error_message: string | null;
+  processed_at: string | null;
+}
+
+export const listDocuments = () =>
+  api.get<DocumentOut[]>("/documents").then((r) => r.data);
+
+export const getDocument = (id: string) =>
+  api.get<DocumentOut>(`/documents/${id}`).then((r) => r.data);
+
+export const getDocumentStatus = (id: string) =>
+  api.get<DocumentStatusOut>(`/documents/${id}/status`).then((r) => r.data);
+
+export const uploadDocument = (file: File) => {
+  const form = new FormData();
+  form.append("file", file);
+  return api.post<DocumentOut>("/documents/upload", form).then((r) => r.data);
+};
+
+export const updateDocumentType = (id: string, document_type: string) =>
+  api.patch<DocumentOut>(`/documents/${id}/type`, { document_type }).then((r) => r.data);
+
+export const deleteDocument = (id: string) =>
+  api.delete(`/documents/${id}`);
+
+export const downloadDocument = async (id: string, filename: string) => {
+  const response = await api.get(`/documents/${id}/file`, { responseType: "blob" });
+  const url = URL.createObjectURL(response.data);
+  const a = document.createElement("a");
+  a.href = url;
+  a.download = filename;
+  a.click();
+  URL.revokeObjectURL(url);
+};
+
+export const assignCategory = (docId: string, catId: string) =>
+  api.post(`/documents/${docId}/categories/${catId}`);
+
+export const removeCategory = (docId: string, catId: string) =>
+  api.delete(`/documents/${docId}/categories/${catId}`);
+
+// --- Categories ---
+export const listCategories = () =>
+  api.get<CategoryOut[]>("/documents/categories").then((r) => r.data);
+
+export const createCategory = (name: string) =>
+  api.post<CategoryOut>("/documents/categories", { name }).then((r) => r.data);
+
+export const renameCategory = (id: string, name: string) =>
+  api.patch<CategoryOut>(`/documents/categories/${id}`, { name }).then((r) => r.data);
+
+export const deleteCategory = (id: string) =>
+  api.delete(`/documents/categories/${id}`);
+
+// --- Settings (admin only) ---
+export interface AIProviderUpdate {
+  provider: string;
+  anthropic_api_key?: string;
+  anthropic_model?: string;
+  ollama_base_url?: string;
+  ollama_model?: string;
+  ollama_api_key?: string;
+  lmstudio_base_url?: string;
+  lmstudio_model?: string;
+  lmstudio_api_key?: string;
+}
+
+export const getDocumentSettings = () =>
+  api.get<Record<string, unknown>>("/settings/documents").then((r) => r.data);
+
+export const updateDocumentAISettings = (data: AIProviderUpdate) =>
+  api.patch<Record<string, unknown>>("/settings/documents/ai", data).then((r) => r.data);
+
+export const testDocumentAIConnection = () =>
+  api.post<{ ok: boolean; provider: string; response?: string; error?: string }>(
+    "/settings/documents/ai/test"
+  ).then((r) => r.data);
+
+export const updateDocumentLimits = (max_pdf_mb: number) =>
+  api.patch<Record<string, unknown>>("/settings/documents/limits", { max_pdf_mb }).then(
+    (r) => r.data
+  );