feat: secure document upload for educator KYC

Adds the upload step for educator verification documents (government ID,
teaching/school certificate). The app previously had no document flow, and its
only upload primitive posted to an unsigned Cloudinary preset that returns a
public secure_url — acceptable for a course thumbnail, not for an identity
document.

Client pre-flight (lib/verification/documents/)
- fileSignature.js reads the leading bytes of the File and identifies the real
  format, naming recognisably hostile payloads (MZ, ELF, ZIP, RAR, gzip, #!)
- policy.js gates on declared MIME, size, and magic-byte agreement. A file that
  fails never reaches the network, so no signed target is requested for it.

Upload path (lib/actions/educators/uploadDocument.js)
- Requests a short-lived signed upload target from the backend, PUTs the bytes
  straight to it, then finalises to start server-side malware scanning
- The signed PUT uses a bare axios client (withCredentials: false) so the
  user's bearer token never reaches the storage origin
- Only { documentId, status, ... } is stored — never a URL

UI
- DocumentUpload.jsx: drag/drop, click-to-browse, camera capture, per-file
  progress, preview, replace, remove, and a scan-pending state resolving to
  accepted or rejected
- Reachable at /educator-onboarding/documents; the liveness capture step now
  routes here on success

Docs
- docs/secure-document-upload.md
- .env.example now states the unsigned Cloudinary preset is course media only

Closes #172

Author: Fury03

.env.example

@@ -18,7 +18,12 @@ NEXT_PUBLIC_DONATION_WALLET=
 
 # ─── Cloudinary ────────────────────────────────────
 NEXT_PUBLIC_CLOUDINARY_CLOUD_NAME=your_cloudinary_cloud_name
-# Cloudinary cloud name for unsigned uploads (required)
+# Cloudinary cloud name for unsigned uploads (required).
+# Unsigned uploads return a PUBLIC secure_url, so this path is for course
+# media only — thumbnails, previews, lesson video.
+# Verification documents (government ID, certificates) must NEVER go through
+# it. They upload to a private, short-lived signed URL issued by the backend;
+# see lib/actions/educators/uploadDocument.js.
 
 # ─── Jitsi ─────────────────────────────────────────
 NEXT_PUBLIC_JITSI_DOMAIN=https://meet.jit.si