feat: migrate app_config volume to storage-service config bucket (Phase 3)

All JSON config files (AI settings, doc settings, appearance, themes) now live
in the 'config' bucket of storage-service instead of a shared Docker volume.

- backend/core/config_storage.py: new async HTTP helpers for config bucket r/w
- backend/core/app_config.py: fully async rewrite; all load_*/save_*/seed_*
  functions use config_storage instead of filesystem
- backend/routers/settings.py: all asyncio.to_thread() wrappers removed; direct
  await calls throughout; update_theme reads via load_theme_by_id()
- backend/main.py: await seed_builtin_themes() directly (no to_thread)
- ai-service: remove CONFIG_PATH, add STORAGE_SERVICE_URL; config_reader now
  fetches from storage-service via httpx
- doc-service: config_reader rewritten to fetch/write via storage-service
- docker-compose: remove app_config volume; add storage-service depends_on for
  ai-service; remove DATA_DIR and CONFIG_PATH from doc-service

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -54,8 +54,6 @@ services:
       DOC_SERVICE_URL: http://doc-service:8001
       AI_SERVICE_URL: http://ai-service:8010
       STORAGE_SERVICE_URL: http://storage-service:8020
-    volumes:
-      - app_config:/config
     depends_on:
       db:
         condition: service_healthy
@@ -73,9 +71,10 @@ services:
     user: "1001:1001"
     restart: unless-stopped
     environment:
-      CONFIG_PATH: /config/ai_service_config.json
-    volumes:
-      - app_config:/config
+      STORAGE_SERVICE_URL: http://storage-service:8020
+    depends_on:
+      storage-service:
+        condition: service_healthy
     networks:
       - backend-net
 
@@ -89,14 +88,10 @@ services:
     restart: unless-stopped
     environment:
       DATABASE_URL: postgresql+asyncpg://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-password}@db:5432/${POSTGRES_DB:-destroying_sap}
-      DATA_DIR: /data/documents
-      CONFIG_PATH: /config/doc_service_config.json
       AI_SERVICE_URL: http://ai-service:8010
       STORAGE_SERVICE_URL: http://storage-service:8020
     volumes:
-      - doc_data:/data/documents
       - watch_data:/data/watch
-      - app_config:/config
     depends_on:
       db:
         condition: service_healthy
@@ -125,10 +120,8 @@ services:
 
 volumes:
   postgres_data:
-  storage_data:  # All file/blob storage — managed by storage-service
-  doc_data:      # PDF files persisted across restarts (to be removed after Phase 2 migration)
+  storage_data:  # All file/blob storage — managed by storage-service (documents + config)
   watch_data:    # Watch directory — bind-mount your NAS/Nextcloud here via docker-compose.override.yml
-  app_config:    # Per-service runtime config JSON files (to be removed after Phase 3 migration)
 
 networks:
   # backend-net: db ↔ backend ↔ doc-service. No host ports bound.