feat: Gemini AI (doc OCR + face match) + role-assignment endpoints

- GeminiService (integrations/gemini, @Global): extractDocument (OCR fields) + faceMatch; graceful if no GEMINI_API_KEY
- documents: face-match now real via Gemini; POST /admin/documents/:id/ocr extracts fields for CS auto-fill
- roles: PATCH /admin/users/:id/role (admin) + POST /platform/users/role (bootstrap via x-platform-secret)
- config: gemini + platform.secret; .env.example entries

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

apps/rider/lib/controller/functions/sss.dart

@@ -0,0 +1,18 @@
+import 'package:secure_string_operations/secure_string_operations.dart';
+
+import '../../constant/char_map.dart';
+import '../../main.dart';
+
+class Sss {
+  static read(String boxname) async {
+    return box.read(X.r(X.r(X.r(boxname, cn), cC), cs));
+  }
+
+  static write(String boxname, value) async {
+    return box.write(boxname, X.c(X.c(X.c(value, cn), cC), cs));
+  }
+
+  static delete(String boxname) async {
+    return box.remove(boxname);
+  }
+}