feat: Gemini AI (doc OCR + face match) + role-assignment endpoints

- GeminiService (integrations/gemini, @Global): extractDocument (OCR fields) + faceMatch; graceful if no GEMINI_API_KEY
- documents: face-match now real via Gemini; POST /admin/documents/:id/ocr extracts fields for CS auto-fill
- roles: PATCH /admin/users/:id/role (admin) + POST /platform/users/role (bootstrap via x-platform-secret)
- config: gemini + platform.secret; .env.example entries

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/.env.example

@@ -52,3 +52,10 @@ NABEH_OTP_TYPE=text
 # ---- FCM push (اتركه فارغاً لتعطيل الإرسال) ----
 FCM_SERVER_KEY=
 FCM_ENDPOINT=https://fcm.googleapis.com/fcm/send
+
+# ---- Gemini (رؤية: قراءة وثائق + مطابقة وجه) ----
+GEMINI_API_KEY=
+GEMINI_MODEL=gemini-2.0-flash
+
+# ---- سرّ المنصة (لتعيين أول أدمن) — ولّده: openssl rand -hex 24 ----
+PLATFORM_SECRET=