Tier-gated RAG + Drive document sources (#42) (#54)

## Summary

Implements epic [#42](#42) (children #43–#53) and advances [#11](#11).

- **Entitlement:** `allows_rag` on plans (founders / backer / pro / business; not standard); exposed as `features.rag`
- **Gates:** document REST + WS `PromptType.RAG` use `assert_feature_allowed(..., "rag")`
- **Lifecycle:** dedupe ingest, delete vectors by `document_id`, honor `active`, fix document detail PATCH/DELETE
- **Workspaces:** auto-create default company workspace; fail-closed scoping
- **Drive:** personal + company Google/Microsoft connect (`link_drive` / `link_company_drive`), resource selection, sync, webhooks stubs, `sync_drive_connections` management command
- **Docs/env:** README + `.env*.example` updated

Companion FE: `chat_web_app` branch `feature/rag-epic-42-ui` (#81–#85).

## Test plan

- [x] `SKIP_RAG_INIT=1 uv run python manage.py test` (457 OK)
- [ ] Migrate finance `0004` + chat_backend `0028` on beta
- [ ] Verify Standard user: Documents API 403 + no RAG retrieval
- [ ] Verify Founders/Pro: upload + list + active toggle
- [ ] Connect Google/Microsoft Drive (incremental scopes) and Sync
- [ ] Company manager: `link_company_drive`; non-manager 403
- [ ] Run `manage.py sync_drive_connections`Reviewed-on: #54

llm_be/finance/admin.py

@@ -12,13 +12,14 @@ class SubscriptionPlanAdmin(admin.ModelAdmin):
         "is_public",
         "is_selectable",
         "allows_image_generation",
+        "allows_rag",
         "allows_all_future_features",
         "prompt_quota_per_window",
         "prompt_window_hours",
         "monthly_token_quota",
         "sort_order",
     )
-    list_filter = ("is_public", "is_selectable", "allows_image_generation")
+    list_filter = ("is_public", "is_selectable", "allows_image_generation", "allows_rag")
     search_fields = ("slug", "name", "stripe_price_id")
     readonly_fields = ("created", "last_modified")
     prepopulated_fields = {"slug": ("name",)}