Add document OCR and exam assessment hub - #21

Scope

Adds the requested assessment expansion on a separate branch without changing production:

• Mistral OCR integration configured by super admin; stored encrypted server-side and never returned to the browser.
• Writing OCR intake with camera, gallery multi-select, files/PDF, guarded ZIP extraction, and allow-listed cloud share URLs.
• OCR writing conversion into the existing secure writing submission + AI grading pipeline with mandatory teacher review before OCR results are released.
• Advanced writing assignments with optional vocabulary and required-pattern inputs, TXT/MD upload, configurable score scale, weighted scoring controls, and school-wide assignment reuse.
• General exam flow: blank exam OCR, filled exam OCR, AI question-level grading, teacher overrides/approval/return, optional student feedback visibility, and student appeals.
• Scale-aware writing results and exports.
• Database RLS, secure import RPCs, OCR/review status synchronization, and cloud URL scrubbing.

Validation plan

• Vercel branch build must stay green.
• GitHub PR CI/lint/test must pass before this branch is considered ready.
• Database migrations are intentionally NOT applied to production in this PR-only stage.
• Railway backend is intentionally NOT deployed from this feature branch; live Mistral OCR E2E requires a staging/production backend plus migrations and a configured Mistral key.

Safety / privacy

• Raw camera/file bytes are forwarded for OCR but are not persisted by Pasific.
• Cloud share URLs are scrubbed from database rows.
• Student identity inferred by OCR is only a suggestion; a teacher must confirm the student before grading.
• OCR writing and exam results stay pending until a teacher reviews/approves them.