Add service admin groups, combined settings pages, single Settings button

- Auto-create {service-id}-admin groups at startup (group_bootstrap.py)
- get_service_admin() dep: grants access to superusers OR service group members
- /api/settings/ai and /api/settings/documents/limits now allow service admins
- AI service exposes /plugin/manifest (ai-service-admin access group)
- DocServiceSettingsPage: combined upload limits + watch directory on one page
- ServiceAdminRoute in frontend guards new /apps/documents/settings and /apps/ai/settings
- Single Settings button per app card (visible to admins and service group members)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/main.py

@@ -6,8 +6,10 @@ from fastapi.middleware.cors import CORSMiddleware
 
 from app.core.app_config import seed_builtin_themes
 from app.core.config import settings
+from app.database import AsyncSessionLocal
 from app.routers import admin, auth, categories_proxy, documents_proxy, groups, plugins, profile, services, users
 from app.routers import settings as settings_router
+from app.services.group_bootstrap import ensure_service_admin_groups
 from app.services.service_health import check_all, health_check_loop, register_services
 
 
@@ -18,6 +20,9 @@ async def lifespan(app: FastAPI):
         doc_service_url=settings.DOC_SERVICE_URL,
         ai_service_url=settings.AI_SERVICE_URL,
     )
+    # Create <service-id>-admin groups for every registered service (idempotent)
+    async with AsyncSessionLocal() as db:
+        await ensure_service_admin_groups(db)
     # Run an initial check immediately so the first API response is accurate
     await check_all()
     task = asyncio.create_task(health_check_loop())