Add paperless-ngx integration for document storage and share links

- dlib/integrations/paperless.py: sync HTTP client wrapping the paperless-ngx
  REST API (upload doc, poll task, create/delete share links, delete document)
- config: PAPERLESS_ENABLED, PAPERLESS_BASE_URL, PAPERLESS_TOKEN, PAPERLESS_TAG_IDS
- PublicAsset model: paperless_document_id + paperless_share_slug columns
- publication service: after creating the asset, if paperless is enabled upload
  the patched PDF and create a share link; stores doc id + share slug on the asset
- public routes: pass expires_at through to publish_version; new
  POST /{slug}/share-links endpoint to (re)create expiring share links on demand
- schemas: PublishRequest.expires_at, PublicAssetResponse.paperless_share_url,
  new ShareLinkRequest model
- frontend: paperless_share_url field on PublicAsset type, createShareLink()
  and expiresAt param on publishVersion() in api.ts
- .env.example: documented paperless env vars

https://claude.ai/code/session_01YPVs6uBwCvcwVMvrfLBBdu

.env.example

@@ -57,6 +57,17 @@ AUTHENTIK_CLIENT_SECRET=
 # Leave blank to use the built-in rule-based tailoring instead of Claude.
 ANTHROPIC_API_KEY=
 
+# ── Paperless-ngx integration (optional) ─────────────────────────────────────
+# When enabled, published CVs are uploaded to your paperless-ngx instance and
+# shared via paperless share links (with optional expiry). MinIO is still used
+# for DOCX artifact storage; paperless handles the published PDF + sharing.
+PAPERLESS_ENABLED=false
+PAPERLESS_BASE_URL=http://localhost:8000
+# API token — obtain via POST /api/token/ with your paperless credentials.
+PAPERLESS_TOKEN=
+# Comma-separated tag IDs to apply to uploaded CV documents (optional).
+PAPERLESS_TAG_IDS=
+
 # ── Demo mode ─────────────────────────────────────────────────────────────────
 # Set to true to enable standalone demo mode in the webapp.
 # Demo mode uses hardcoded dummy data — no backend or DB required.