feat(phase-4-05): document streaming proxy GET /api/documents/{id}/content (DOC-02)

- Add _parse_range() helper: validates Range header bounds, raises 416 on invalid
- Add stream_document_content endpoint with get_regular_user dep (admin → 403)
- Access check: owner OR Share.recipient_id; neither → 404
- Bytes fetched via get_object() only — presigned_get_url() never called
- Range requests return 206 + Content-Range header
- Add pdf_open_mode column to User ORM model (migration 0004 already applied)
- Use HTTP_416_RANGE_NOT_SATISFIABLE (non-deprecated constant)

backend/db/models.py

@@ -61,6 +61,9 @@ class User(Base):
     default_storage_backend: Mapped[str] = mapped_column(
         String, nullable=False, default="minio"
     )
+    pdf_open_mode: Mapped[str] = mapped_column(
+        String, nullable=False, server_default="in_app"
+    )
     created_at: Mapped[datetime] = mapped_column(
         TIMESTAMP(timezone=True), nullable=False, server_default=func.now()
     )