fix(chat): honor the Word add-in's documentContext on POST /chat

POST /chat silently dropped the add-in's `documentContext` field (it
parsed only messages/chat_id/project_id/model/ask_inputs_response), so
the Chat tab's "Use document as context" toggle and the Workflows tab
ran WITHOUT the document - no error, just answers that never saw the
text. The add-in README's claim that the chat route fences the document
into the system prompt was false against this tree.

Port the fork's minimal backend support:

- parseOptionalDocumentContext: validate the optional string field
  (400 on non-strings), trim, and cap at 200k chars so an oversized
  body can't blow the context window.
- buildWordDocumentContextPrompt: inject the document into the system
  prompt via buildMessages's existing (previously unused on this route)
  systemPromptExtra parameter. The body is user-controlled text and a
  prompt-injection vector, so it is nonce-fenced via spotlight() -
  unpredictable per-request nonce on BOTH tags, smuggled fence tokens
  HTML-encoded, echoed nonces redacted - preceded by an instruction
  that it is reference content, not instructions.
- Focused vitest coverage for the parsing, the fence, and the
  end-to-end injection through buildMessages.

This makes the PR no longer purely additive to word-addin/: it touches
backend/src/routes/chat.ts and backend/src/lib/chat/contextBuilders.ts,
because without the backend half the add-in's headline feature does not
work.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>