feat: Gemini AI (doc OCR + face match) + role-assignment endpoints

- GeminiService (integrations/gemini, @Global): extractDocument (OCR fields) + faceMatch; graceful if no GEMINI_API_KEY
- documents: face-match now real via Gemini; POST /admin/documents/:id/ocr extracts fields for CS auto-fill
- roles: PATCH /admin/users/:id/role (admin) + POST /platform/users/role (bootstrap via x-platform-secret)
- config: gemini + platform.secret; .env.example entries

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

apps/rider/lib/controller/home/deep_link_controller.dart

@@ -0,0 +1,42 @@
+import 'dart:async';
+import 'package:app_links/app_links.dart';
+import 'package:get/get.dart';
+
+class DeepLinkController extends GetxController {
+  final _appLinks = AppLinks();
+  StreamSubscription<Uri>? _linkSubscription;
+
+  // تخزين الرابط الخام (URL) ليتم معالجته لاحقاً في MapPassengerController
+  final Rx<String?> rawDeepLink = Rx<String?>(null);
+
+  @override
+  void onInit() {
+    super.onInit();
+    initDeepLinks();
+  }
+
+  Future<void> initDeepLinks() async {
+    // الاستماع للروابط والتطبيق يعمل في الخلفية
+    _linkSubscription = _appLinks.uriLinkStream.listen((uri) {
+      print('🔗 Received deep link (Stream): $uri');
+      rawDeepLink.value = uri.toString();
+    });
+
+    // الاستماع للروابط إذا كان التطبيق مغلقاً تماماً (Cold Start)
+    try {
+      final initialUri = await _appLinks.getInitialLink();
+      if (initialUri != null) {
+        print('🔗 Received initial deep link (Cold Start): $initialUri');
+        rawDeepLink.value = initialUri.toString();
+      }
+    } catch (e) {
+      print('Error getting initial link: $e');
+    }
+  }
+
+  @override
+  void onClose() {
+    _linkSubscription?.cancel();
+    super.onClose();
+  }
+}