Tier-gated RAG + Drive document sources (#42) (#54)

## Summary

Implements epic [#42](#42) (children #43–#53) and advances [#11](#11).

- **Entitlement:** `allows_rag` on plans (founders / backer / pro / business; not standard); exposed as `features.rag`
- **Gates:** document REST + WS `PromptType.RAG` use `assert_feature_allowed(..., "rag")`
- **Lifecycle:** dedupe ingest, delete vectors by `document_id`, honor `active`, fix document detail PATCH/DELETE
- **Workspaces:** auto-create default company workspace; fail-closed scoping
- **Drive:** personal + company Google/Microsoft connect (`link_drive` / `link_company_drive`), resource selection, sync, webhooks stubs, `sync_drive_connections` management command
- **Docs/env:** README + `.env*.example` updated

Companion FE: `chat_web_app` branch `feature/rag-epic-42-ui` (#81–#85).

## Test plan

- [x] `SKIP_RAG_INIT=1 uv run python manage.py test` (457 OK)
- [ ] Migrate finance `0004` + chat_backend `0028` on beta
- [ ] Verify Standard user: Documents API 403 + no RAG retrieval
- [ ] Verify Founders/Pro: upload + list + active toggle
- [ ] Connect Google/Microsoft Drive (incremental scopes) and Sync
- [ ] Company manager: `link_company_drive`; non-manager 403
- [ ] Run `manage.py sync_drive_connections`Reviewed-on: #54

llm_be/finance/tests/test_plans_quotas.py

@@ -55,6 +55,24 @@ class PlanCatalogTestCase(TestCase):
         self.assertFalse(plans["backer"].is_selectable)
         self.assertTrue(plans["backer"].allows_all_future_features)
 
+    def test_seed_allows_rag_matrix(self):
+        """#43: RAG is gated per-plan — standard is the only tier without it."""
+        plans = {p.slug: p for p in seed_subscription_plans()}
+
+        self.assertTrue(plans["founders"].allows_rag)
+        self.assertFalse(plans["standard"].allows_rag)
+        self.assertTrue(plans["pro"].allows_rag)
+        self.assertTrue(plans["business"].allows_rag)
+        self.assertTrue(plans["backer"].allows_rag)
+
+    def test_allows_feature_recognizes_rag_aliases(self):
+        plans = {p.slug: p for p in seed_subscription_plans()}
+
+        self.assertTrue(plans["pro"].allows_feature("rag"))
+        self.assertTrue(plans["pro"].allows_feature("document_rag"))
+        self.assertFalse(plans["standard"].allows_feature("rag"))
+        self.assertFalse(plans["standard"].allows_feature("document_rag"))
+
 
 class BackerRedeemTestCase(TestCase):
     def setUp(self):
@@ -126,6 +144,23 @@ class QuotaGateTestCase(TestCase):
         )
         assert_feature_allowed(self.user, "image_generation")
 
+    def test_business_allows_rag(self):
+        business = SubscriptionPlan.objects.get(slug="business")
+        assign_plan(self.user, plan=business, source=UserSubscription.Source.ADMIN)
+        assert_feature_allowed(self.user, "rag")
+
+    def test_feature_gate_blocks_rag_on_standard(self):
+        with self.assertRaises(FeatureNotAllowed) as ctx:
+            assert_feature_allowed(self.user, "rag")
+        self.assertEqual(ctx.exception.code, "feature_not_allowed")
+
+    def test_pro_allows_rag(self):
+        pro = SubscriptionPlan.objects.get(slug="pro")
+        assign_plan(
+            self.user, plan=pro, source=UserSubscription.Source.ADMIN
+        )
+        assert_feature_allowed(self.user, "rag")
+
     def test_token_quota_blocks_when_reported(self):
         self.plan.monthly_token_quota = 50
         self.plan.prompt_quota_per_window = 1000