feat: govern board files as permission-aware AI knowledge

[adme-dev]

Summary

• adds a governed Board Files → Knowledge workflow with extraction, management review, approval/rejection/archive/retry, indexing, and source-aware citations
• adds the management review queue to AI Knowledge and permission-aware board retrieval for the assistant
• routes native PDF/Office parsing through a private board-knowledge-extractor service-bound Worker so the Pages bundle remains within its release budget
• keeps AI document escalation behind Model Ops and Cloudflare AI Gateway privacy controls; retrieval remains disabled by default
• adds a deterministic nine-class extraction benchmark and operational runbook

This is intentionally a review-first stacked PR. It targets feature/board-files-library (PR #374), and no production deployment was performed.

Privacy and access posture

• uploaded document bytes are sent only to the private extractor service binding or the configured AI Gateway path
• extractor responses are no-store; gateway payload logging and caching are disabled
• working files are not AI knowledge until management approves them
• Postgres and Vectorize retrieval both enforce department/board ACLs
• rejected, archived, deleted, stale, and superseded versions are de-indexed or excluded

Rollout gates

1. Review and merge PR feat: add board-level Files library #374 first, then this PR.
2. Deploy workers/board-knowledge-extractor before deploying Pages so the private service binding resolves.
3. Apply/verify migrations 342 and 343 and provision the documented Vectorize index/metadata indexes.
4. Configure paid Gateway credentials and run the AI benchmark in an approved non-production environment before enabling AI fallback.
5. Keep assistant retrieval disabled until resource, backfill, and benchmark checks are signed off.

Verification

• pnpm vitest run: 1474 files passed, 8653 tests passed (5 files / 10 tests skipped)
• final focused regression run: 5 files, 38 tests passed
• pnpm --dir workers/board-knowledge-extractor typecheck: passed
• pnpm --dir workers/board-knowledge-extractor build: passed, 3.54 MiB / 825.8 KiB gzip
• pnpm build: passed, Pages worker 23.58 MiB / 23.60 MiB release budget
• pnpm typecheck: existing repository backlog remains (857 errors); no errors in changed board-knowledge, UI, benchmark, or Worker paths
• native benchmark: passed all nine document classes; scanned PDF correctly escalates to needs_ai
• AI benchmark: not run because approved paid Gateway credentials were not present
• local Chrome/Playwright: desktop and 320 px review queue/article form verified in dark mode with labelled controls and no horizontal overflow; public Boards/Knowledge/help copy also verified
• migration 342 re-applied idempotently and knowledge tables verified in the configured Neon database
• non-production agency-knowledge Vectorize index provisioned at 768 dimensions with cosine distance and scopeKey metadata indexing
• dry-run backfill completed with parity true and zero existing articles to migrate

Notes for reviewers

• the companion parser Worker is deliberately private (workers_dev = false) and owns no storage, database, or review permissions
• native parsing remains available in local Nuxt development through a development-only import
• lifecycle state and non-management mutation restrictions are covered by component/API tests; the review branch did not mutate a live authenticated board fixture