Tier-gated RAG + Drive document sources (#42) (#54)

## Summary

Implements epic [#42](#42) (children #43–#53) and advances [#11](#11).

- **Entitlement:** `allows_rag` on plans (founders / backer / pro / business; not standard); exposed as `features.rag`
- **Gates:** document REST + WS `PromptType.RAG` use `assert_feature_allowed(..., "rag")`
- **Lifecycle:** dedupe ingest, delete vectors by `document_id`, honor `active`, fix document detail PATCH/DELETE
- **Workspaces:** auto-create default company workspace; fail-closed scoping
- **Drive:** personal + company Google/Microsoft connect (`link_drive` / `link_company_drive`), resource selection, sync, webhooks stubs, `sync_drive_connections` management command
- **Docs/env:** README + `.env*.example` updated

Companion FE: `chat_web_app` branch `feature/rag-epic-42-ui` (#81–#85).

## Test plan

- [x] `SKIP_RAG_INIT=1 uv run python manage.py test` (457 OK)
- [ ] Migrate finance `0004` + chat_backend `0028` on beta
- [ ] Verify Standard user: Documents API 403 + no RAG retrieval
- [ ] Verify Founders/Pro: upload + list + active toggle
- [ ] Connect Google/Microsoft Drive (incremental scopes) and Sync
- [ ] Company manager: `link_company_drive`; non-manager 403
- [ ] Run `manage.py sync_drive_connections`Reviewed-on: #54

llm_be/chat_backend/serializers.py

@@ -13,6 +13,7 @@ from .models import (
     FEEDBACK_CATEGORIES,
     DocumentWorkspace,
     Document,
+    DriveConnection,
 )
 
 
@@ -279,3 +280,37 @@ class DocumentSerializer(serializers.ModelSerializer):
             "active",
         ]
         read_only_fields = ["id", "uploaded_at", "processed", "created"]
+
+
+# drive connection serializers (#47-#52)
+class DriveConnectionSerializer(serializers.ModelSerializer):
+    """Never exposes access_token/refresh_token to the client."""
+
+    class Meta:
+        model = DriveConnection
+        fields = [
+            "id",
+            "provider",
+            "kind",
+            "external_account_email",
+            "selected_resource_ids",
+            "selected_resource_labels",
+            "last_sync_at",
+            "last_sync_status",
+            "last_sync_error",
+            "is_active",
+            "created",
+        ]
+        read_only_fields = fields
+
+
+class DriveConnectionResourcesSerializer(serializers.Serializer):
+    resource_ids = serializers.ListField(
+        child=serializers.CharField(max_length=512), allow_empty=True
+    )
+    resource_labels = serializers.ListField(
+        child=serializers.CharField(max_length=512, allow_blank=True),
+        allow_empty=True,
+        required=False,
+        default=list,
+    )