Add service admin groups, combined settings pages, single Settings button

- Auto-create {service-id}-admin groups at startup (group_bootstrap.py)
- get_service_admin() dep: grants access to superusers OR service group members
- /api/settings/ai and /api/settings/documents/limits now allow service admins
- AI service exposes /plugin/manifest (ai-service-admin access group)
- DocServiceSettingsPage: combined upload limits + watch directory on one page
- ServiceAdminRoute in frontend guards new /apps/documents/settings and /apps/ai/settings
- Single Settings button per app card (visible to admins and service group members)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/services/service_health.py

@@ -52,7 +52,7 @@ def register_services(doc_service_url: str, ai_service_url: str) -> None:
             internal_url=doc_service_url,
             health_path="/health",
             app_path="/apps/documents",
-            settings_path="/apps/documents/settings/admin",
+            settings_path="/apps/documents/settings",
         ),
         ServiceDefinition(
             id="ai-service",
@@ -61,7 +61,7 @@ def register_services(doc_service_url: str, ai_service_url: str) -> None:
             internal_url=ai_service_url,
             health_path="/health",
             app_path="",
-            settings_path="/apps/ai/settings/admin",
+            settings_path="/apps/ai/settings",
         ),
     ]