Tier-gated RAG + Drive document sources (#42) (#54)

## Summary

Implements epic [#42](#42) (children #43–#53) and advances [#11](#11).

- **Entitlement:** `allows_rag` on plans (founders / backer / pro / business; not standard); exposed as `features.rag`
- **Gates:** document REST + WS `PromptType.RAG` use `assert_feature_allowed(..., "rag")`
- **Lifecycle:** dedupe ingest, delete vectors by `document_id`, honor `active`, fix document detail PATCH/DELETE
- **Workspaces:** auto-create default company workspace; fail-closed scoping
- **Drive:** personal + company Google/Microsoft connect (`link_drive` / `link_company_drive`), resource selection, sync, webhooks stubs, `sync_drive_connections` management command
- **Docs/env:** README + `.env*.example` updated

Companion FE: `chat_web_app` branch `feature/rag-epic-42-ui` (#81–#85).

## Test plan

- [x] `SKIP_RAG_INIT=1 uv run python manage.py test` (457 OK)
- [ ] Migrate finance `0004` + chat_backend `0028` on beta
- [ ] Verify Standard user: Documents API 403 + no RAG retrieval
- [ ] Verify Founders/Pro: upload + list + active toggle
- [ ] Connect Google/Microsoft Drive (incremental scopes) and Sync
- [ ] Company manager: `link_company_drive`; non-manager 403
- [ ] Run `manage.py sync_drive_connections`Reviewed-on: #54

llm_be/finance/models.py

@@ -40,6 +40,10 @@ class SubscriptionPlan(TimeInfoBase):
     )
     allows_text_generation = models.BooleanField(default=True)
     allows_image_generation = models.BooleanField(default=False)
+    allows_rag = models.BooleanField(
+        default=False,
+        help_text="Drive/RAG document sync (Google Drive, OneDrive, SharePoint).",
+    )
     allows_all_future_features = models.BooleanField(
         default=False,
         help_text="Founders/Backer: unlock new capabilities as they ship.",
@@ -74,6 +78,8 @@ class SubscriptionPlan(TimeInfoBase):
             return self.allows_text_generation
         if feature in ("image", "image_generation"):
             return self.allows_image_generation
+        if feature in ("rag", "document_rag"):
+            return self.allows_rag
         return False