feat: add page citation source API

[suguanYang]

Summary

• Add v2-only GET /v2/documents/{document_id}/files/page-citation-source for SDK page-memory citation rendering.
• Return signed URL JSON for the normalized source.pdf raw result artifact, including document/job IDs, variant: normalized_pdf, content type, file name, URL, and expiry.
• Return 404 for non-page-memory documents, missing source.pdf, archived documents, or documents outside the caller account.
• Keep this endpoint out of /v1; existing document routes continue to be mounted under /v2.
• Refs Add original/normalized file download API for SDK page-memory citations #201.

Verification

• uv run --all-packages --group dev pytest apps/api/tests/contract/test_documents_contract.py -q -> 16 passed
• uv run --all-packages --group dev pytest apps/api/tests/contract/test_page_memory_parse_track_contract.py -q -> 18 passed, one existing duplicate health operation-id warning
• make lint -> passed
• make typecheck -> 0 errors
• git diff --check -> passed before commit
• Local API and worker smoke, PDF fixture apps/worker/tests/fixtures/sample_3pages.pdf: v2 upload, confirm-upload, page-memory parse done, page-citation-source returned 200, signed URL fetched PDF bytes successfully.
• Local API and worker smoke, PPTX fixture apps/worker/tests/fixtures/sample_5slides.pptx: v2 upload, confirm-upload, page-memory parse done via LibreOffice fallback normalization, page-citation-source returned 200, signed URL fetched normalized PDF bytes successfully.
• Full worker/parser suite was not run; this change is scoped to API document routing/storage signing and covered by focused API contracts plus local API/worker smoke.

Deployment Notes

• No database migrations.
• No new environment variables.
• Uses the existing page-memory worker behavior that persists and uploads source.pdf as an internal raw result artifact.
• Backward compatible: new endpoint is v2-only and returns 404 when the page-citation source is unavailable.

Checklist

• Tests were added or updated when behavior changed
• Public docs, examples, or OpenAPI contracts were updated when needed
• Database migrations are idempotent and safe to deploy
• Logs, errors, and validation paths avoid leaking secrets or user data
• The pull request description explains any breaking or user-visible change