feat: Microsoft Word add-in (Office.js task pane) for Mike

From the PR description

Summary

Adds an Office.js Word task pane add-in that brings Mike directly into Microsoft Word, plus the minimal backend changes it needs. Lawyers work in Word; this removes the copy-out/paste-back friction by putting Mike's chat, one-click actions, saved workflows, and project document access inside Word, and applying AI output as native tracked-change redlines.

Two commits:

1. feat(backend) - Word add-in compatibility (CORS + documentContext)
2. feat(word-addin) - the standalone add-in (word-addin/)

What works

• Chat about the open document, with optional full-document context (sent as documentContext, fenced into the system prompt). Streaming responses; insert at cursor or apply as a tracked change.
• Actions: Improve Writing, Proofread, Anonymise, Draft Clause.
• Workflows: run any saved Mike workflow against the document.
• Projects: browse projects, upload the open document as .docx.
• Auth directly against Supabase; token persisted in OfficeRuntime.storage.
• Hermetic Playwright e2e (word-addin/e2e/) - 48 tests covering every flow against a mocked Office.js host and stubbed backend (no Word/Supabase/live backend needed). All passing on this branch.

Backend changes (small, additive)

• backend/src/index.ts - CORS becomes an allowlist (FRONTEND_URL + https://localhost:3000, the HTTPS origin Office tooling forces), still allows no-Origin server-to-server calls, and permits the Authorization/Content-Type headers + PATCH.
• backend/src/routes/chat.ts and backend/src/routes/projectChat.ts - accept an optional documentContext string and append it (fenced in <word-document>) to the LLM system prompt via the existing systemPromptExtra path. No new tables or endpoints.

Backend tsc --noEmit passes.

What does NOT work / out of scope

• Tracked changes require Word desktop (WordApi 1.4). Word-on-the-web degrades to "insert at cursor".
• The live desktop sideload flow was not run in CI/this environment (no Word + hosted Supabase here) - the hermetic e2e is the verified part. word-addin/scripts/dev.sh automates the live setup (cert install, env from frontend/.env.local, HTTPS proxy for the local HTTP backend, sideload) but may need env tweaks for your Supabase project.
• The add-in is a standalone build (its own package.json/webpack), intentionally decoupled from the frontend/backend builds.

How to run / extend

cd backend && npm run dev          # backend on :3001
bash word-addin/scripts/dev.sh     # reads frontend/.env.local, builds, sideloads into Word
cd word-addin && npm run test:e2e  # hermetic e2e

• Add a tab: drop a component under word-addin/src/taskpane/components/ and register it in App.tsx.
• New backend calls go through word-addin/src/taskpane/api/client.ts (typed SSE stream parser + auth header injection).
• Word document interaction is isolated in word-addin/src/taskpane/hooks/useWordDoc.ts.

See word-addin/README.md for setup, sideloading, the feature matrix, and troubleshooting.

🤖 Generated with Claude Code