feat: Gemini AI (doc OCR + face match) + role-assignment endpoints

- GeminiService (integrations/gemini, @Global): extractDocument (OCR fields) + faceMatch; graceful if no GEMINI_API_KEY
- documents: face-match now real via Gemini; POST /admin/documents/:id/ocr extracts fields for CS auto-fill
- roles: PATCH /admin/users/:id/role (admin) + POST /platform/users/role (bootstrap via x-platform-secret)
- config: gemini + platform.secret; .env.example entries

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/app.module.ts

@@ -27,6 +27,7 @@ import { NotificationsModule } from './modules/notifications/notifications.modul
 import { PaymentsModule } from './modules/payments/payments.module';
 import { StorageModule } from './common/storage/storage.module';
 import { DocumentsModule } from './modules/documents/documents.module';
+import { GeminiModule } from './integrations/gemini/gemini.module';
 
 @Module({
   imports: [
@@ -56,6 +57,7 @@ import { DocumentsModule } from './modules/documents/documents.module';
     NabehModule, // عالمي — إرسال OTP واتساب
     NotificationsModule, // عالمي — FCM
     StorageModule, // عالمي — تخزين ملفات الوثائق
+    GeminiModule, // عالمي — رؤية AI (وثائق + وجه)
 
     HealthModule,
     TenantsModule,