feat: Phase 4+5 — admin storage UI, backend proxy, CLAUDE.md enforcement

- backend/app/routers/storage_config.py: 5 admin-only endpoints proxying
  storage-service config + migration API (GET/PATCH/POST/DELETE)
- backend/app/main.py: register storage_config router
- frontend/src/api/client.ts: StorageStatus, MigrationStatus,
  StorageBackendConfig interfaces + 5 API functions
- frontend/src/pages/StorageAdminPage.tsx: full admin UI — backend health
  dot, driver selector (local/S3/WebDAV), conditional credential fields,
  Test & Migrate button, live 2s-poll migration progress bar, Cancel
- frontend/src/App.tsx: /admin/storage route (AdminRoute guard)
- CLAUDE.md: storage enforcement rule, updated Docker tables (6 services,
  3 volumes), §20 in merge checklist
- backend/CLAUDE.md, frontend/CLAUDE.md, doc-service/CLAUDE.md,
  ai-service/CLAUDE.md: updated to reflect storage-service integration
- tests/ALL_TESTS.md + tests/storage-service_tests.md: §20 (20 tests)
- backend/STATUS.md, frontend/STATUS.md: updated with new endpoints/routes
- changelog/2026-04-20_storage-service.md: full change log

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

features/ai-service/CLAUDE.md

@@ -22,7 +22,8 @@ features/ai-service/
 │   │   ├── queue.py               ← GET /queue/status, /pause, /resume, /cancel/{id}
 │   │   └── plugin.py              ← GET /plugin/manifest (access rules for ai-service-admin group)
 │   └── services/
-│       └── queue.py               ← Priority queue (CRITICAL > HIGH > NORMAL)
+│       ├── queue.py               ← Priority queue (CRITICAL > HIGH > NORMAL)
+│       └── config_reader.py       ← Reads ai_service_config.json from storage-service config bucket (30 s TTL cache)
 ├── Dockerfile                     ← python:3.12-slim, non-root user 1001
 └── STATUS.md
 ```

features/doc-service/CLAUDE.md

@@ -1,6 +1,6 @@
 # doc-service — Claude context
 
-PDF extraction microservice, port 8001 (internal). Shares the same PostgreSQL instance as the backend. Receives proxied requests from `backend:8000`, which injects `x-user-id` and `x-user-groups` headers — doc-service trusts these headers directly. Calls `ai-service:8010` for document classification. See root `CLAUDE.md` for architecture, Docker, and project-wide workflows.
+PDF extraction microservice, port 8001 (internal). Shares the same PostgreSQL instance as the backend. Receives proxied requests from `backend:8000`, which injects `x-user-id` and `x-user-groups` headers — doc-service trusts these headers directly. Calls `ai-service:8010` for document classification. All file/blob storage goes through `storage-service:8020` — no files are written directly to the filesystem. See root `CLAUDE.md` for architecture, Docker, and project-wide workflows.
 
 ---
 
@@ -38,13 +38,14 @@ features/doc-service/
 │   │   ├── categories.py          ← Category CRUD (includes watch-owned categories)
 │   │   └── plugin.py              ← GET /plugin/manifest, GET+PATCH /plugin/settings
 │   └── services/
-│       ├── storage.py             ← File I/O
+│       ├── storage.py             ← Storage client: save_upload/download_file/delete_file → storage-service:8020 documents bucket
 │       ├── ai_client.py           ← classify_document() → ai-service:8010/chat
-│       ├── config_reader.py       ← Config load/save including storage/watch settings
+│       ├── config_reader.py       ← Config load/save via storage-service config bucket (doc_service_config.json)
 │       └── file_watcher.py        ← watchdog-based PDF watcher + startup scan + ingestion
 ├── alembic/versions/              ← Migration chain
 │   ├── 0003_add_watch_columns.py  ← source, watch_path, suggested_folder, suggested_filename
-│   └── 0004_add_document_shares.py ← document_shares table (group-based sharing)
+│   ├── 0004_add_document_shares.py ← document_shares table (group-based sharing)
+│   └── 0008_rename_file_path_to_storage_key.py ← file_path → storage_key; strips /data/documents/ prefix from existing rows
 ├── Dockerfile                     ← python:3.12-slim, non-root user 1001
 └── STATUS.md
 ```
@@ -60,7 +61,7 @@ features/doc-service/
 | `id` | String | PK, UUID | |
 | `user_id` | String | indexed | not FK — trusts x-user-id header |
 | `filename` | String | NOT NULL | |
-| `file_path` | String | NOT NULL | absolute path under /data/documents |
+| `storage_key` | String | NOT NULL | storage-service key: `{user_id}/{doc_id}.pdf` (documents bucket) |
 | `file_size` | Integer | NOT NULL | bytes |
 | `status` | String | default="pending" | pending / processing / done / failed |
 | `title` | String(500) | nullable | AI-extracted |
@@ -118,6 +119,7 @@ Unique constraint: `(document_id, group_id)`
 | `0005` | `add_share_can_delete` |
 | `0006` | `add_category_scope` |
 | `0007` | `capitalize_system_category_names` |
+| `0008` | `rename_file_path_to_storage_key` |
 
 ---