Add tier-gated RAG and Drive document sources (#42)

Ship allows_rag entitlement (founders/backer/pro/business), enforce it on
document APIs and RAG chat, harden ingest/delete/active lifecycle, and add
Google/Microsoft Drive connect + sync for personal and company knowledge bases.

Closes #43 #44 #45 #46 #47 #48 #49 #50 #51 #52 #53
Parent epic: #42
Related: #11

.env.example

@@ -32,6 +32,12 @@ ENABLE_ACCOUNT_REGISTRATION=false
 # Redirect URIs (register in each IdP console):
 #   {OAUTH_CALLBACK_BASE_URL}/api/auth/oauth/google/callback/
 #   {OAUTH_CALLBACK_BASE_URL}/api/auth/oauth/microsoft/callback/
+# Same client id/secret pair is reused for Drive linking (#47) — the extra
+# Drive scopes below are requested incrementally via intent=link_drive /
+# intent=link_company_drive, no separate app registration needed:
+#   Google:    openid email profile https://www.googleapis.com/auth/drive.readonly
+#   Microsoft: openid email profile offline_access Files.Read (personal)
+#              openid email profile offline_access Files.Read.All Sites.Read.All (company)
 GOOGLE_OAUTH_CLIENT_ID=
 GOOGLE_OAUTH_CLIENT_SECRET=
 MICROSOFT_OAUTH_CLIENT_ID=
@@ -40,6 +46,22 @@ MICROSOFT_OAUTH_TENANT=common
 # Optional; defaults to request host. Example local: http://127.0.0.1:8001
 OAUTH_CALLBACK_BASE_URL=http://127.0.0.1:8001
 
+# Drive / RAG sync (#47-#53). Requires a subscription plan with allows_rag
+# (Founders, Pro, Business, Backer by default — see finance PLAN_SEED).
+# Start a link:  GET  /api/auth/oauth/google/start/?intent=link_drive             (authenticated)
+#                GET  /api/auth/oauth/google/start/?intent=link_company_drive     (company manager)
+#                GET  /api/auth/oauth/microsoft/start/?intent=link_drive
+#                GET  /api/auth/oauth/microsoft/start/?intent=link_company_drive
+# Manage:        GET    /api/drive/connections/
+#                DELETE /api/drive/connections/<id>/
+#                POST   /api/drive/connections/<id>/resources/   { "resource_ids": [...] }
+#                POST   /api/drive/connections/<id>/sync/
+# Provider push notifications (best-effort; register with each provider's
+# subscription/watch API pointing here, using ?connection_id=<id>):
+#   POST {OAUTH_CALLBACK_BASE_URL}/api/drive/webhooks/google/
+#   POST {OAUTH_CALLBACK_BASE_URL}/api/drive/webhooks/microsoft/
+# Worker sync: `python manage.py sync_drive_connections [--connection-id N]`
+
 # Stripe / finance (optional local — required for checkout + webhooks)
 STRIPE_SECRET_KEY=
 STRIPE_PUBLISHABLE_KEY=