feat: Gemini AI (doc OCR + face match) + role-assignment endpoints

- GeminiService (integrations/gemini, @Global): extractDocument (OCR fields) + faceMatch; graceful if no GEMINI_API_KEY
- documents: face-match now real via Gemini; POST /admin/documents/:id/ocr extracts fields for CS auto-fill
- roles: PATCH /admin/users/:id/role (admin) + POST /platform/users/role (bootstrap via x-platform-secret)
- config: gemini + platform.secret; .env.example entries

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

apps/driver/android/app/src/main/res/values/strings.xml

@@ -0,0 +1,15 @@
+<resources>
+    <string name="app_name">My App</string>
+    <string name="default_notification_channel_id">high_importance_channel</string>
+    <string name="api_key">kffk</string>
+    <string name="api_key_safety">AIzaSyB04YNW3LbvmQ5lX1t2bOwEU18-</string>
+    <string name="channel_name">FCM Notifications</string>
+    <string name="channel_description">Notifications from Firebase Cloud Messaging</string>
+    <string name="security_warning_title">Security Warning</string>
+    <string name="security_warning_message">A security issue or modification has been detected on
+        this device. The app cannot run on this device.</string>
+    <string name="exit_button">Exit App</string>
+    <string name="device_secure">Device is secure. Proceeding normally.</string>
+
+
+</resources>