[Sam123ben]

Closes #411

Changes

• Locks document-changing controls while a durable OCR job is active, including cancellation-pending state.
• Adds a signed, tenant-scoped cancellation route and UI action.
• Keeps lifecycle state visible during refreshes and adds a bounded browser-session activity timeline.
• Keeps worker logs, document content, storage locators, and credentials out of the browser.

Verification

• npm test (95 passing)
• npm run lint
• npx tsc --noEmit
• npx next build --webpack
• PYTHONPATH=src uv run --extra dev python -m pytest tests/unit/test_document_intelligence_client.py tests/unit/test_document_intelligence_routes.py -q (16 passing)
• uv run --extra dev ruff check ... and format check