feat: integrate Paperless-ngx document workflows

[brdweb]

Summary

• connect and health-check a Paperless-ngx install from Settings > Developer, with API tokens encrypted at rest using a dedicated AES-256-GCM key
• select existing Paperless documents and either link them without copying bytes or retain an independent MotoMate copy
• copy or move local MotoMate documents to Paperless through asynchronous, retryable jobs; moves retain the local file until Paperless confirms ingestion
• make ownership explicit in the document UI and guarantee that MotoMate removal/disconnect actions never delete Paperless content
• open supported files inline in the browser, keep Download explicit, proxy Paperless thumbnails, and lazily generate/cache WebP thumbnails for local PDFs and raster images
• replace maintenance/spending attachment JSON with validated document_links, including purchase/sale relations and migration of existing attachments

Document ownership semantics

Action	Result
Link from Paperless	MotoMate stores metadata/reference only; Paperless remains authoritative
Copy from Paperless	MotoMate stores a local copy and keeps the Paperless reference
Copy to Paperless	Both durable copies remain after Paperless confirms ingestion
Move to Paperless	MotoMate removes its local object only after confirmed Paperless success
Remove from MotoMate	Removes the MotoMate record/local object only; never calls a Paperless delete endpoint

Deployment notes

• Set INTEGRATION_ENCRYPTION_KEY to a stable 32-byte value before creating a connection (openssl rand -hex 32). Do not reuse AUTH_SECRET.
• Back up the database before deployment. Migration 0009_cheerful_catseye.sql creates integration, sync-job, and document-link tables and migrates existing maintenance/spending attachments.
• The MotoMate container must be able to reach the configured Paperless base URL.
• Local and S3 storage identities need read/write/delete access to thumbnails/ keys in addition to existing document objects.
• Full setup, action semantics, backup/restore, and troubleshooting notes are in docs/paperless-integration.md.

Validation

• npm run lint — pass
• npm run check — pass (0 errors, 0 warnings)
• focused Paperless/document suite — 27/27 pass
• npm run build — pass
• Docker image builds successfully on the project's Node 20 slim image, including the native thumbnail renderer
• homelab smoke test against a live Paperless library:
  • authenticated linked thumbnail: 200 image/webp with valid WebP content
  • inline linked preview: 200 application/pdf
  • unauthenticated thumbnail: 401
  • container health: healthy

The full suite currently reports 250 passing and 6 failing tests in src/tests/api/attention-utils.test.ts. Those failures are the existing timezone-sensitive date assertions; both that test file and its implementation are unchanged from upstream/main and are outside this PR.

Safety and rollback

• The migration is forward-only; take a SQLite backup before upgrade.
• Paperless documents are never deleted by this integration, so rolling back MotoMate cannot remove archive content.
• For a rollback, restore the pre-migration MotoMate database together with the matching application image. Local upload data remains independently backed by the configured storage volume.

[brdweb]

I tried to ensure the minimal amount of changes to the project for those who don't wish to use paperless with it. Within my homelab using paperless on the same docker host but using domain access to paperless it worked well. Feel free to provide any feedback or changes as you see fit before merging.

[hawkinslabdev]

@brdweb Review is still pending as this pr is still in draft.

[hawkinslabdev]

@brdweb Review will be done next week (due to a lack of time on my end)!