feat: Gemini AI (doc OCR + face match) + role-assignment endpoints

- GeminiService (integrations/gemini, @Global): extractDocument (OCR fields) + faceMatch; graceful if no GEMINI_API_KEY
- documents: face-match now real via Gemini; POST /admin/documents/:id/ocr extracts fields for CS auto-fill
- roles: PATCH /admin/users/:id/role (admin) + POST /platform/users/role (bootstrap via x-platform-secret)
- config: gemini + platform.secret; .env.example entries

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

apps/driver/lib/controller/auth/tokens_controller.dart

@@ -0,0 +1,38 @@
+import 'dart:convert';
+
+import 'package:sefer_driver/views/widgets/error_snakbar.dart';
+import 'package:get/get.dart';
+import 'package:http/http.dart' as http;
+
+import '../../constant/box_name.dart';
+import '../../constant/links.dart';
+import '../../main.dart';
+
+class TokenController extends GetxController {
+  bool isloading = false;
+
+  Future addToken() async {
+    String? basicAuthCredentials =
+        await storage.read(key: BoxName.basicAuthCredentials);
+    isloading = true;
+    update();
+    var res = await http.post(
+      Uri.parse(AppLink.addTokens),
+      headers: {
+        'Authorization':
+            'Basic ${base64Encode(utf8.encode(basicAuthCredentials.toString()))}',
+      },
+      body: {
+        'token': box.read(BoxName.tokenFCM.toString()),
+        'passengerID': box.read(BoxName.passengerID).toString()
+      },
+    );
+
+    isloading = false;
+    update();
+    var jsonToken = jsonDecode(res.body);
+    if (jsonToken['status'] == 'The token has been updated successfully.') {
+      mySnackbarSuccess('token updated'.tr);
+    }
+  }
+}