Task-based extraction grouping

AC:
- Users can create task-specific extractions isolated from other tasks
- Users can create document-level (global) extractions visible across all task contexts
- OCR workflows triggered by task events create task-scoped extractions
- OCR workflows triggered by document events create document-scoped extractions
- Task queue navigation maintains proper extraction scope isolation
- All existing tests pass and new tests provide adequate coverage
- Scope-filtered queries perform within acceptable limits (< 200ms)
- No database migrations are required

### Endpoint changes

New **`POST /badgerdoc/task/{task_id}/extractions/`**
- Creates a task-scoped extraction automatically linked to the specified task via `TaskExtraction`
- `document_id` is derived from the task.

New **`GET /document/{document_id}/latest-extraction-pages/`**
- Add optional `task_id` query parameter
- When `task_id` is provided: return both task-specific and global extraction pages
- Without `task_id` (backward compatible): return only document-global pages

Scope derivation logic:
- Extraction **with** a `TaskExtraction` link → task-scoped
- Extraction **without** a `TaskExtraction` link → document-scoped (global)

Permissions:
- Task-scoped extractions - visible to task assignee and staff with `view_other_users_tasks`, on the UI, visible in case of task view.
- Document-scoped extractions - existing permission model unchanged.

Potential follow-up UI changes:
1. Workspace page - detect task vs. document context from route (`/tasks/$taskId` vs. `/documents/$id`) and pass `task_id` to extraction page queries accordingly.
2. Extraction creation flow - use `POST /badgerdoc/task/{task_id}/extractions/` when in task context; use existing endpoint when in document context.