Add service admin groups, combined settings pages, single Settings button

- Auto-create {service-id}-admin groups at startup (group_bootstrap.py)
- get_service_admin() dep: grants access to superusers OR service group members
- /api/settings/ai and /api/settings/documents/limits now allow service admins
- AI service exposes /plugin/manifest (ai-service-admin access group)
- DocServiceSettingsPage: combined upload limits + watch directory on one page
- ServiceAdminRoute in frontend guards new /apps/documents/settings and /apps/ai/settings
- Single Settings button per app card (visible to admins and service group members)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/routers/settings.py

@@ -31,7 +31,7 @@ from app.core.app_config import (
     validate_theme_tokens,
 )
 from app.core.config import settings
-from app.deps import get_current_admin, get_current_user
+from app.deps import get_current_admin, get_current_user, get_service_admin
 from app.models.user import User
 
 router = APIRouter()
@@ -96,7 +96,7 @@ class ThemeUpdate(BaseModel):
 
 @router.get("/ai")
 async def get_ai_settings(
-    _: User = Depends(get_current_admin),
+    _: User = Depends(get_service_admin("ai-service")),
 ) -> dict:
     return load_ai_service_config_masked()
 
@@ -104,7 +104,7 @@ async def get_ai_settings(
 @router.patch("/ai")
 async def update_ai_settings(
     body: AIProviderUpdate,
-    _: User = Depends(get_current_admin),
+    _: User = Depends(get_service_admin("ai-service")),
 ) -> dict:
     valid_providers = ("anthropic", "ollama", "lmstudio")
     if body.provider not in valid_providers:
@@ -145,7 +145,7 @@ async def update_ai_settings(
 
 @router.post("/ai/test")
 async def test_ai_connection(
-    _: User = Depends(get_current_admin),
+    _: User = Depends(get_service_admin("ai-service")),
 ) -> dict:
     """Proxy a minimal chat request to ai-service to verify the connection."""
     try:
@@ -171,7 +171,7 @@ async def test_ai_connection(
 
 @router.get("/documents/limits")
 async def get_documents_limits(
-    _: User = Depends(get_current_admin),
+    _: User = Depends(get_service_admin("doc-service")),
 ) -> dict:
     return load_doc_service_config_masked()
 
@@ -179,7 +179,7 @@ async def get_documents_limits(
 @router.patch("/documents/limits")
 async def update_documents_limits(
     body: LimitsUpdate,
-    _: User = Depends(get_current_admin),
+    _: User = Depends(get_service_admin("doc-service")),
 ) -> dict:
     if body.max_pdf_mb < 1 or body.max_pdf_mb > 200:
         raise HTTPException(status_code=422, detail="max_pdf_mb must be between 1 and 200")
@@ -195,7 +195,7 @@ async def update_documents_limits(
 
 @router.get("/system-prompts")
 async def get_system_prompts(
-    _: User = Depends(get_current_admin),
+    _: User = Depends(get_service_admin("ai-service")),
 ) -> dict:
     """Return all editable system prompts, keyed by service id."""
     return await asyncio.to_thread(load_all_system_prompts)
@@ -205,7 +205,7 @@ async def get_system_prompts(
 async def update_system_prompt(
     service_id: str,
     body: SystemPromptUpdate,
-    _: User = Depends(get_current_admin),
+    _: User = Depends(get_service_admin("ai-service")),
 ) -> dict:
     """Update the system prompts for a single service."""
     if service_id not in SYSTEM_PROMPT_SERVICES: