Tier-gated RAG + Drive document sources (#42) (#54)

## Summary

Implements epic [#42](#42) (children #43–#53) and advances [#11](#11).

- **Entitlement:** `allows_rag` on plans (founders / backer / pro / business; not standard); exposed as `features.rag`
- **Gates:** document REST + WS `PromptType.RAG` use `assert_feature_allowed(..., "rag")`
- **Lifecycle:** dedupe ingest, delete vectors by `document_id`, honor `active`, fix document detail PATCH/DELETE
- **Workspaces:** auto-create default company workspace; fail-closed scoping
- **Drive:** personal + company Google/Microsoft connect (`link_drive` / `link_company_drive`), resource selection, sync, webhooks stubs, `sync_drive_connections` management command
- **Docs/env:** README + `.env*.example` updated

Companion FE: `chat_web_app` branch `feature/rag-epic-42-ui` (#81–#85).

## Test plan

- [x] `SKIP_RAG_INIT=1 uv run python manage.py test` (457 OK)
- [ ] Migrate finance `0004` + chat_backend `0028` on beta
- [ ] Verify Standard user: Documents API 403 + no RAG retrieval
- [ ] Verify Founders/Pro: upload + list + active toggle
- [ ] Connect Google/Microsoft Drive (incremental scopes) and Sync
- [ ] Company manager: `link_company_drive`; non-manager 403
- [ ] Run `manage.py sync_drive_connections`Reviewed-on: #54

llm_be/chat_backend/admin.py

@@ -11,6 +11,7 @@ from .models import (
     PromptMetric,
     DocumentWorkspace,
     Document,
+    DriveConnection,
     UserAuthEvent,
     OutboundEmail,
     OAuthIdentity,
@@ -213,9 +214,36 @@ class DocumentAdmin(admin.ModelAdmin):
     model = Document
     list_display = (
         "file",
+        "source",
         "active",
         "created",
         "processed",
+        "drive_connection",
+    )
+    list_filter = ("source", "active", "processed")
+    raw_id_fields = ("drive_connection",)
+
+
+class DriveConnectionAdmin(admin.ModelAdmin):
+    model = DriveConnection
+    list_display = (
+        "provider",
+        "kind",
+        "company",
+        "user",
+        "external_account_email",
+        "is_active",
+        "last_sync_status",
+        "last_sync_at",
+    )
+    list_filter = ("provider", "kind", "is_active", "last_sync_status")
+    search_fields = ("external_account_email", "company__name", "user__email")
+    raw_id_fields = ("company", "user")
+    readonly_fields = (
+        "created",
+        "last_modified",
+        "access_token",
+        "refresh_token",
     )
 
 
@@ -233,6 +261,7 @@ admin.site.register(Feedback, FeedbackAdmin)
 
 admin.site.register(DocumentWorkspace, DocumentWorkspaceAdmin)
 admin.site.register(Document, DocumentAdmin)
+admin.site.register(DriveConnection, DriveConnectionAdmin)
 
 
 class OAuthIdentityAdmin(admin.ModelAdmin):