Adopt agents-settings kit, ship Product/SKU scan models, harden auth, verify OCR accuracy

Backend (app-pfm-ocr-v2/backend):
- Product/SKU scan feature complete: trained DINOv2 index (118 reference
  photos, 16 SKU classes) and YOLO classifier (83.3% top-1 val accuracy),
  fixed scripts/install-pipeline.sh (was missing ultralytics/torch), fully
  browser-verified end-to-end on /scan-pfm. Mobile m-scan-pfm page cancelled
  (Flutter app handles mobile; web UI is desktop-only for pipeline testing).
- Fixed a real data-loss bug: Save Ground Truth (scan-pfm and the DO-flow's
  manual-label) was silently writing into the pfm-web-app container's
  ephemeral filesystem instead of the host, because /sources wasn't
  bind-mounted in docker-compose.yml. Added the mount, recovered an
  orphaned entry.
- accounts.password is now bcrypt-hashed (bcryptjs, idempotent migration
  in db/init.ts) instead of plaintext; login route compares hashes.
- /api/v1/documents/* (list, PUT, upload) now enforces real 401 auth,
  matching what the Flutter client already sends. The "classic" routes
  deliberately stay open — they're dev-only web UI with no login flow and
  won't exist in production.
- OCR accuracy investigated end-to-end: real baseline is 95.10% overall
  (target met; accuracy_report.md was stale at 75.04%, now flagged). Fixed
  one genuine parser.ts bug (SO/DO field duplication in the global fallback
  regex); remaining gaps are OCR/layout-model limitations, not parser bugs.
- Adopted a standalone copy of the fhanyuh/agents-settings e/n workflow
  scoped to backend/ (AGENTS.md Part A/B split, SKILLS.md, plans/, docs/),
  independent of the root copy which now covers Flutter only.
- next-implementation.md deleted; content folded into
  backend/plans/next-enhancements.md for traceability.

Root:
- Adopted fhanyuh/agents-settings kit (AGENTS.md, SKILLS.md, plans/,
  docs/feature-list.md), scoped to the Flutter app only.
- Pending documents queue now persists to Hive (lib/core/storage) instead
  of memory-only, surviving an app kill mid-upload.

Removed backend_backup/ (stale Express/Prisma prototype, superseded by
pfm-web-app) and the completed plans/next-enhancement-plan.md checklist.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

lib/models/document_model.dart

@@ -59,6 +59,37 @@ class DocumentModel {
     );
   }
 
+  /// Round-trips with [fromJson]. Used to persist a document to Hive, both for
+  /// the confirmed-documents box and the in-flight pending-documents queue.
+  Map<String, dynamic> toJson() {
+    return {
+      'id': id,
+      'created_at': createdAt.toIso8601String(),
+      'latitude': latitude,
+      'longitude': longitude,
+      'nama_driver': namaDriver,
+      'nama_penerima': namaPenerima,
+      'header': {
+        'tanggal': tanggal,
+        'no_po': noPo,
+        'no_so': noSo,
+        'no_do': noDo,
+      },
+      'shipment': {
+        'kepada_yth': kepadaYth,
+        'order_untuk': orderUntuk,
+        'alamat': alamat,
+        'plat_truk': platTruk,
+      },
+      'items': items.map((e) => {
+        'nomor_sku': e.nomorSku,
+        'nama_barang': e.namaBarang,
+        'banyak': e.banyak,
+        'jumlah': e.jumlah,
+      }).toList(),
+    };
+  }
+
   /// Body for `PUT /api/v1/documents/:id`. Shared by the editor's initial save and
   /// the pending-queue's sync retry so both send an identical payload shape.
   Map<String, dynamic> toPutPayload() {