feat: Gemini AI (doc OCR + face match) + role-assignment endpoints

- GeminiService (integrations/gemini, @Global): extractDocument (OCR fields) + faceMatch; graceful if no GEMINI_API_KEY
- documents: face-match now real via Gemini; POST /admin/documents/:id/ocr extracts fields for CS auto-fill
- roles: PATCH /admin/users/:id/role (admin) + POST /platform/users/role (bootstrap via x-platform-secret)
- config: gemini + platform.secret; .env.example entries

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

apps/driver/lib/controller/functions/encrypt.dart

@@ -0,0 +1,32 @@
+import 'dart:convert';
+import 'package:encrypt/encrypt.dart' as encrypt;
+
+import '../../constant/api_key.dart';
+
+class KeyEncryption {
+  // استخدم مفتاح بطول 32 حرفًا
+  static final _key = encrypt.Key.fromUtf8(AK.keyOfApp);
+  static final _iv =
+      encrypt.IV.fromLength(16); // توليد تهيئة عشوائية بطول 16 بايت
+
+  static String encryptKey(String key) {
+    final encrypter =
+        encrypt.Encrypter(encrypt.AES(_key, mode: encrypt.AESMode.cbc));
+    final encrypted = encrypter.encrypt(key, iv: _iv);
+    final result = _iv.bytes + encrypted.bytes; // تضمين التهيئة مع النص المشفر
+    return base64Encode(result);
+  }
+
+  static String decryptKey(String encryptedKey) {
+    print('encryptedKey: ${AK.keyOfApp}');
+
+    final decoded = base64Decode(encryptedKey);
+    print('encryptedKey: $encryptedKey');
+    final iv = encrypt.IV(decoded.sublist(0, 16)); // استخراج التهيئة
+    final encrypted =
+        encrypt.Encrypted(decoded.sublist(16)); // استخراج النص المشفر
+    final encrypter =
+        encrypt.Encrypter(encrypt.AES(_key, mode: encrypt.AESMode.cbc));
+    return encrypter.decrypt(encrypted, iv: iv);
+  }
+}