feat(documents): search and import from Paperless-ngx and Papra on request

A person stores one connection per system (base address, Papra
organization id, API token encrypted at rest) and can search it by
document name with tag and date filters, then import picked documents
one per request through the same ingest path as an upload: source-key
answer before any download, content dedup, deleted stays deleted, quota,
provenance, and the person's own AI reading setting. An import can link
the document to the visit, condition or vaccination it was picked for.

The operator lists the instances in DOCUMENT_SOURCE_ORIGINS; unset, the
feature is off. Only listed origins are contacted, through safeFetch with
the origin pinned, redirects refused, timeouts and byte caps. The routes
are cookie-only and owner-only. The token is registered for rotation,
removed by Delete all data, and not carried in backups.

.env.example

@@ -103,6 +103,20 @@ API_TOKEN_HMAC_KEY="REPLACE-WITH-OUTPUT-OF-openssl-rand-hex-32"
 # NOTIFICATION_PRIVATE_ORIGINS=""
 
 
+# -----------------------------------------------------------------------------
+# Document picker: Paperless-ngx and Papra -- optional
+# -----------------------------------------------------------------------------
+# The Paperless-ngx and Papra instances people may connect to pick documents
+# from, comma-separated exact origins (scheme://host[:port], no path), e.g.
+# "https://paperless.example.com,http://papra.lan:1221". Unset, the document
+# picker is switched off. Only a listed origin is ever contacted, public or
+# private; requests are pinned to it, redirects are not followed, and
+# link-local, metadata and unspecified addresses stay refused even when
+# listed. A malformed entry is logged once and grants nothing.
+# See docs/self-hosting/document-sources.md.
+# DOCUMENT_SOURCE_ORIGINS=""
+
+
 # -----------------------------------------------------------------------------
 # AI Provider (optional)
 # -----------------------------------------------------------------------------