feat(documents): module gate, nav, and review-then-confirm UI

Add the opt-in inboundDocuments module (off by default, like the MCP
endpoint): ingesting a clinical document egresses it to the OCR/vision
provider, so the surface ships dark and the user turns it on from the
Modules hub. The born-gated /documents page carries the prominent
non-diagnostic disclaimer (we read, we don't interpret; nothing is saved
until you approve it; only your clinician can interpret these results),
uploads a document, and walks each extracted fact: source provenance and
confidence are shown, low-confidence facts are blocked from approval until
edited, and the confirm step commits the approved facts.

src/components/settings/modules-section.tsx

@@ -31,6 +31,7 @@ import {
   CalendarHeart,
   Droplet,
   Dumbbell,
+  FileScan,
   FileText,
   MessageCircleHeart,
   Moon,
@@ -74,6 +75,8 @@ const MODULE_ICONS: Record<ModuleKey, LucideIcon> = {
   doctorReport: FileText,
   // v1.22.0 — the remote MCP endpoint (opt-in connectivity module).
   mcp: Plug,
+  // v1.25.0 (W-DOCS-IN) — inbound clinical documents (opt-in).
+  inboundDocuments: FileScan,
 };
 
 export function ModulesSection() {