Add Milestone 4 document retrieval

[KanuTomer]

Summary

• records the completed, budget-bounded Milestone 3 acceptance
• adds deterministic PPTX, PDF, Markdown, and UTF-8 text ingestion
• adds transactional SQLite FTS5 indexing, top-five bounded retrieval, local search/inspection UI, and strict citation validation
• adds the 50-case offline M4 evaluator, packaged-Electron FTS5 smoke, and Windows artifact upload
• preserves stock NSIS behavior while using app-builder-lib's static uninstaller extractor so enforced Smart App Control is not weakened

Validation

• npm ci (patch applies cleanly)
• npm run verify: 99/99 Vitest and 7/7 .NET tests
• npm audit --audit-level=high: 0 vulnerabilities
• npm run eval:m4: 50/50 top-five recall
• npm run test:helper-smoke: 16 kHz mono WASAPI capture, temp file deleted
• npm run package:win: unsigned NSIS installer generated
• staged diff, credential, local-path, binary, generated-artifact, and redaction scans passed

The packaged executable smoke remains a required Windows CI gate because this development host's Smart App Control blocks launching all unsigned executables. No OpenAI request or API credit was used for M4. No public release or code signing is included.