feat(ai): self-host enablement for BYO endpoints: poppler in the runner image, backend-agnostic smoke script, docs (#1743)

Sovereign plan WS1 PR2, stacked on the extraction-first service (#1740).

- Dockerfile (runner stage): `apk add --no-cache poppler-utils`, the one
  system package beyond the base image (~4 MB plus shared libs, pdftoppm
  25.12 on node:22-alpine). pdftoppm renders the first pages of a PDF for
  AI backends with no native PDF input (an OpenAI-compatible Swedish
  endpoint); page images land in /tmp, which docker-compose.yml already
  mounts as tmpfs under the read-only root. Hosted (Bedrock) never calls
  it; the cron image is untouched.
- scripts/smoke-ai-provider.ts: the self-hoster's "is AI wired up"
  command. Prints provider, models per tier, PDF mode (+ whether
  pdftoppm is present), vision/strict-JSON; then one text generation per
  tier model, one schema-shaped answer and, given a file, the exact
  document-extraction path an upload takes. Skips are reported as
  failures with the fix. Reads .env.local then .env.
- docs/SELF-HOSTING.md: verifying section rewritten around the new
  script (smoke-ai.ts stays for the assistant's Anthropic-only parameter
  probes); rasterizer/tmpfs notes; .env.example gains
  AI_PDF_RASTERIZER_BIN; DECISIONS entry.

Verified: live against hosted Bedrock (text per tier, structured, PDF
extraction) and against a local OpenAI-compatible mock with
AI_PROVIDER=openai-compatible (the mock received Bearer auth, per-tier
model ids and one image_url part per rasterized page; extraction parsed
the fenced JSON answer). poppler-utils probed on node:22-alpine.

Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

.env.example

@@ -97,6 +97,7 @@ RECEIPT_HUNT_COMPANY_IDS=
 #                                 # (images/PDFs are then skipped honestly; HTML mail still extracts)
 # AI_PDF_MODE=auto                # auto (Claude: native, others: rasterize with poppler) | native | rasterize
 # AI_PDF_MAX_PAGES=4              # pages rasterized per PDF
+# AI_PDF_RASTERIZER_BIN=pdftoppm   # poppler binary name/path (the self-host image installs poppler-utils)
 # AI_STRICT_JSON=false            # openai-compatible only: response_format json_schema when the provider enforces it
 # AI_EXTRACTION_MAX_TOKENS=8192   # output cap for document extraction (legacy BEDROCK_MAX_TOKENS)
 # AI_PROVIDER=