feat: add Mistral OCR provider

[ADabbler]

Summary

Add Mistral OCR as a configurable OCR provider for image extraction and PDF OCR fallback.

The backend sends PDF and image inputs to the Mistral OCR API as data URIs, preserves the returned page-level Markdown, and reuses existing timeout, outbound URL validation, redirect policy, tracing, and sensitive-setting handling. The admin file settings page now provides Mistral endpoint, API key, model, and timeout fields.

Change type

• Feature
• Documentation
• Configuration / deployment
• Security hardening

Affected areas

• Frontend / UI
• Backend / API
• Files / RAG / extraction
• Model routing / providers
• Admin console
• Documentation

Verification

• pnpm check
• pnpm test
• pnpm build
• git diff --check
• Manual verification: configured Mistral OCR in the admin console and successfully extracted both an image and a PDF.

Screenshots, API examples, or logs

Configuration, migration, and compatibility notes

Mistral OCR can be selected from the admin file settings page. Configure:

• extract:mistral_ocr_base_url (default: https://api.mistral.ai/v1/ocr)
• extract:mistral_ocr_auth_token
• extract:mistral_ocr_model (default: mistral-ocr-latest)
• extract:mistral_ocr_timeout_seconds (default: 60)

Mistral OCR follows the existing image_ocr_enabled and pdf_ocr_fallback_enabled controls. No database migration, public API contract change, generated artifact update, or additional deployment service is required.

Documentation

• Documentation was updated.

Security and privacy

• No secrets, tokens, credentials, local config, or personal data are included.
• User data access remains scoped by authenticated user context unless an admin-only path explicitly requires broader access.
• Security-sensitive behavior was reviewed, including authentication, authorization, provider routing, file processing, billing, and admin APIs where relevant.

Checklist

• I searched existing issues and pull requests.
• Changes are focused and do not include unrelated refactors.
• Tests or static verification were run where practical.
• User-facing behavior, deployment steps, API contracts, or configuration changes are documented.
• Generated artifacts are included only when this project explicitly requires them.
• Caches, build output, .pyc files, .env files, and local storage data are not committed.