Add PDF document service with AI extraction and per-app settings

- New `features/doc-service` FastAPI microservice: PDF upload, async
  text extraction (pdfplumber), AI classification via Anthropic/Ollama/
  LM Studio, per-user categories, file download
- Alembic migration isolated with `alembic_version_doc_service` table
- Main backend: httpx proxy routers for /api/documents/* and
  /api/documents/categories/*, admin settings API at /api/settings/*
- Runtime config in /config/doc_service_config.json (shared Docker
  volume); api_key masking on reads; atomic write with os.replace()
- Frontend: DocumentsPage, DocumentAdminSettingsPage, updated AppsPage
  launcher hub, simplified Nav (removed Settings link), new routes
- docker-compose: doc-service service, doc_data + app_config volumes,
  removed internal:true from backend-net for outbound AI API calls
- Fix pre-commit hook: probe Docker socket path so git subprocess picks
  up Docker Desktop on macOS
- Fix security_check.py: use sys.executable for bandit so venv python
  is used instead of system python

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/components/Nav.tsx

@@ -15,16 +15,11 @@ export default function Nav() {
       padding: "12px 24px",
       borderBottom: "1px solid #ccc",
     }}>
-      <Link to="/">Home</Link>
+      <Link to="/" style={{ fontWeight: "bold" }}>Home</Link>
       <Link to="/apps">Apps</Link>
-      <Link to="/settings">Settings</Link>
       {user?.is_admin && <Link to="/admin">Admin</Link>}
-      <button
-        onClick={logout}
-        style={{ marginLeft: "auto", cursor: "pointer" }}
-      >
-        Logout
-      </button>
+      <Link to="/profile" style={{ marginLeft: "auto" }}>Profile</Link>
+      <button onClick={logout} style={{ cursor: "pointer" }}>Logout</button>
     </nav>
   );
 }