feat: Gemini AI (doc OCR + face match) + role-assignment endpoints

- GeminiService (integrations/gemini, @Global): extractDocument (OCR fields) + faceMatch; graceful if no GEMINI_API_KEY
- documents: face-match now real via Gemini; POST /admin/documents/:id/ocr extracts fields for CS auto-fill
- roles: PATCH /admin/users/:id/role (admin) + POST /platform/users/role (bootstrap via x-platform-secret)
- config: gemini + platform.secret; .env.example entries

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

apps/rider/key/CertificateSigningRequest.certSigningRequest

@@ -0,0 +1,16 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIICmDCCAYACAQAwUzEmMCQGCSqGSIb3DQEJARYXaGFtemFheWVkZGV2QGljbG91
+ZC5jb20xHDAaBgNVBAMME0hhbXphIEFsZWdod2FpcnllZW4xCzAJBgNVBAYTAkpP
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA9VnNN4Mp4mQyTHKS4UhX
+DDl9zMaBGnlWx7NqJin3Vim+Jq3CvprO3HTx6PG+Ub92VZWOje0fx8v72P87xqG1
+eQpbqPnv6rC/8PuQDoKu7GD/vDfAfrculpIJRyVcAew8yCLfDq6VMqP3qjR4j12p
+mWfFV48JFuK7pk+qR8LEi5cs42QLIxgEcMEZcJNqZxp7L/cdf+CT7ceA5yoI1RA8
+0LP4zGbXdPBFr+2AYWiN5mo06WvK8GRKm2Dzsw9zd2s3nhJoiP98oVr4J5wgG84K
+ODp1uHH0HA4+9/IL8NEptstCIxy3Dx7TpRoTG7OcvCLtb5k7hNNMhzI5l6HBvksS
+ywIDAQABoAAwDQYJKoZIhvcNAQELBQADggEBAGkumJGj7p8pUernVuQVDTbV8sxQ
+Bqi60zXjNiKD0L8yxMrk9M4vQDmJGoNtoMRQk29Rqkti1Oeoo5oN65tqgDe6LTA6
++LQAgrd/uKFmki5419mBfCM4nJC98HaLVIv/nfNk7jUd8WDW73EaE5193xHMTYLL
+37zZIr3Og0gIWptXeXvBYPVwlS7oZpBODW0qsI+D6oKfGtXQRvxK8IdZhbIaKyZp
+6zc5xrBJVvScHuRFSiLqT1Z07cHiMvkOPA3DycfYr+ifPL5aot6GAiqVM4v3y7PS
+3/T5UiNi69tdWY2wCOrYnbJTgf7CAyquPjXYfifWA+BrrPxIMKvf1SLz370=
+-----END CERTIFICATE REQUEST-----