Add native OneNote workspace uploads

[Paul Lizer (paullizer)]

Summary

• Support native .one sections and .onepkg notebooks in personal, group, and public workspaces. Index typed text and tables with section/page/subpage context; each package remains one workspace document.
• Add a pinned local Rust extractor with strict CAB validation, complete-section checks, bounded memory/CPU/output, safe errors, and a Python adapter. No external conversion service, Graph connection, OCR, handwriting recognition, or embedded-attachment ingestion.
• Package the executable, third-party notices/licenses, and rebuildable corresponding source in the Azure Linux container. Preserve existing authorization, document lifecycle, text citations, and direct-chat attachment behavior.
• Update feature/user/admin documentation, format display, regression coverage, and release notes for v0.261.045. Rebuild the container or native component to deploy; configured upload limits still apply (128 MiB native input ceiling).

The branch is rebased onto current Development. Leave this PR unmerged; do not enable auto-merge.

Linked issue

None. Issue creation was explicitly declined for this work.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Version bump

• application/single_app/config.py VERSION third segment bumped: 0.261.044 -> 0.261.045 after syncing with Development
• deployers/version.txt bump not needed: deployers/ was not changed

Testing / validation

• Post-rebase targeted Python and template suite: 58 passed, 5 opt-in native checks skipped. Covers test_onenote_extractor_runtime.py, test_onenote_workspace_ingestion.py, test_onenote_upload_dispatch.py, test_onenote_native_integration.py, test_mixed_source_manifest_contracts.py, and test_workspace_supported_file_types_modal.py.
• The five native integration checks passed separately against the packaged Linux runtime, non-root with networking disabled. Both user-supplied exports were read locally; the notebook yielded 11 sections/225 pages, including 221 pages with typed body/title content. The standalone body matched its notebook counterpart. Private inputs and extracted contents are not committed.
• Real-file workspace processing with substituted Azure I/O: one bounded chunk for the standalone section and 227 bounded chunks for the notebook, with scope preserved across personal/group/public paths.
• Native component: 63 tests passed, formatting and strict Linux/Windows-target clippy passed. Windows runtime acceptance was not run.
• Six desktop/mobile Bootstrap modal interaction cases passed. Six configured-application upload/status browser cases were skipped because no authenticated UI environment was supplied; those workflows mock uploads rather than sending notebooks to a browser service.
• Optimized Python OneNote suite: 42 tests, 5 opt-in native skips.
• docker build --target onenote-runtime passed. The shipped corresponding source rebuilt successfully with cargo build --release --frozen --offline and networking disabled.
• Documentation inventory/coverage and site-quality checks passed. All 12 route-policy checks passed after rebase. Commit whitespace checks passed.
• Known pre-existing test issue: four neighboring test_markdown_chunk_size_enforcement.py tests fail because their test namespace lacks save_chunks_batch. The Markdown processor and that test file are unchanged by this PR; no unrelated fix is included.

Documentation

• Release notes updated under v0.261.045
• Feature documentation updated: docs/explanation/features/ONENOTE_INGESTION.md, upload guides, chunking guidance, and logging tags
• Fix documentation not needed: this is a new feature

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security()) — no new routes; existing route policies verified
• Settings sent to non-admin frontends use sanitize_settings_for_user() — existing settings boundaries unchanged
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, private notebooks, extracted private text, or local build artifacts are included

The public native test fixtures retain source provenance and MPL-2.0 attribution. The pinned parser compatibility commit is documented explicitly rather than presented as part of the released parser version.