Fix runtime and consolidate Document Manager

[JayRHa]

What changed

• declare DocumentManager as the canonical repository
• add a safe .env.example and Docker context exclusions
• replace shell evaluation of .env with Docker --env-file
• remove the unused second ChromaDB/supervisor process
• align backup paths and fix typed settings access
• harden tar backup extraction and local bind defaults
• remove the unused sentence-transformers/PyTorch dependency chain
• update security-sensitive dependency pins
• add regression tests for configuration, backup extraction, and runtime layout

Why

DocumentManagement and DocumentManager had diverged. The maintained repository also contained duplicated Chroma storage, inconsistent backup paths, unsafe environment loading, and obsolete runtime dependencies. This change makes DocumentManager the single maintained implementation before the legacy repository is archived.

Verification

• 14 passed
• bash -n setup.sh docker-entrypoint.sh
• production Docker image built successfully
• isolated container returned HTTP 200 from /api/health
• runtime contained one Uvicorn process and /app/data/backups