Add tier-gated RAG and Drive document sources (#42)

Ship allows_rag entitlement (founders/backer/pro/business), enforce it on
document APIs and RAG chat, harden ingest/delete/active lifecycle, and add
Google/Microsoft Drive connect + sync for personal and company knowledge bases.

Closes #43 #44 #45 #46 #47 #48 #49 #50 #51 #52 #53
Parent epic: #42
Related: #11

.env.prod.example

@@ -53,6 +53,12 @@ ENABLE_ACCOUNT_REGISTRATION=false
 # Register redirect URIs:
 #   https://chatbackend.aimloperations.com/api/auth/oauth/google/callback/
 #   https://chatbackend.aimloperations.com/api/auth/oauth/microsoft/callback/
+# Same client id/secret pair covers Drive linking (#47); no extra IdP app
+# registration needed, but do register the Drive/Graph API + consent screen
+# scopes below in each console (incremental scopes requested at intent time):
+#   Google:    openid email profile https://www.googleapis.com/auth/drive.readonly
+#   Microsoft: openid email profile offline_access Files.Read (personal)
+#              openid email profile offline_access Files.Read.All Sites.Read.All (company)
 GOOGLE_OAUTH_CLIENT_ID=
 GOOGLE_OAUTH_CLIENT_SECRET=
 MICROSOFT_OAUTH_CLIENT_ID=
@@ -60,6 +66,13 @@ MICROSOFT_OAUTH_CLIENT_SECRET=
 MICROSOFT_OAUTH_TENANT=common
 OAUTH_CALLBACK_BASE_URL=https://chatbackend.aimloperations.com
 
+# Drive / RAG sync (#47-#53) — gated by SubscriptionPlan.allows_rag.
+# Register provider push notifications (Google Drive `watch`, Microsoft
+# Graph subscriptions) against:
+#   https://chatbackend.aimloperations.com/api/drive/webhooks/google/
+#   https://chatbackend.aimloperations.com/api/drive/webhooks/microsoft/
+# Scheduled sync (cron / server-infra job): `python manage.py sync_drive_connections`
+
 # Stripe / finance
 STRIPE_SECRET_KEY=replace-with-stripe-secret-key
 STRIPE_PUBLISHABLE_KEY=replace-with-stripe-publishable-key