Personal Drive/RAG without a company (#55) (#56)

## Summary
- Closes [#55](#55) (related [#46](#46))
- **Personal** Google Drive / OneDrive works for users **without** a company (personal RAG)
- **Company** Drive still requires company + manager
- Schema: nullable `DriveConnection.company`, personal `DocumentWorkspace.user`, ownership check constraints + conditional uniques
- Runtime: `ensure_personal_workspace`, personal sync → personal WS, chat/document APIs fall back to personal WS when `company_id` is null
- Supersedes the interim "reject with `no_company`" approach (wrong for personal connect)

## Test plan
- [x] OAuth: personal Drive callback with `user.company=NULL` succeeds (`company_id=NULL` on connection)
- [x] OAuth: company Drive still returns `no_company` / `forbidden` appropriately
- [x] Chat tenant scope creates personal workspace for solo users
- [x] Drive sync + document view suites (`91` related tests)
- [ ] Manual: solo entitled user connects Google Drive → success, sync lands in personal workspace
- [ ] Manual: company manager company Drive still works
- [ ] Migrate prod/staging with `0029_personal_drive_rag_without_company`Reviewed-on: #56

README.md

@@ -214,7 +214,9 @@ Subscription audit (`UserAuthEvent` on the user admin):
 ### Drive / RAG sync ([#47](https://git.aimloperations.com/ai_ml_operations/chat_backend/issues/47)-[#53](https://git.aimloperations.com/ai_ml_operations/chat_backend/issues/53))
 
 Personal Google Drive / OneDrive and company Google Shared Drive / SharePoint
-sync into the existing RAG `Document` pipeline. Every endpoint below is gated
+sync into the existing RAG `Document` pipeline. Personal connections work for
+users **without** a company (personal workspace); company connections require a
+company manager. Every endpoint below is gated
 by `assert_feature_allowed(user, "rag")` (`SubscriptionPlan.allows_rag` —
 true for Founders/Pro/Business/Backer, false for Standard by default).