Surface document ID in extraction failure notifications and error states

[muness]

Goal

When extraction fails, there is no visible way in the UI to identify which document failed or why. The Postgres error detail is redacted, and the document ID only appears buried in Render logs. Users need a way to identify and act on failed documents without digging through logs.

Context

• The extraction worker logs LogError(ex, "Failed to extract document {DocId}", docId) — document ID is in logs but not surfaced in the UI
• Postgres check constraint violations redact detail by default (Include Error Detail connection string flag needed)
• PR fix: correct document data integrity -- names, dates, finalization, visible IDs #126 added a copyable 8-char ID to the documents list, but failed documents in an error state don't show enough context to act on them

Acceptance Criteria

• Documents with status = 'failed' show the full document ID (copyable) in the documents list and detail view
• Failed documents show the failure reason/error type (from audit_events.details) in the UI — even if just "Extraction failed" with a timestamp
• The GET /documents endpoint includes failureReason (from latest extraction_failed audit event) in the response for failed documents
• Consider: add Include Error Detail to the Render connection string so Postgres errors are not redacted in logs (low risk for a demo env)

Notes

Discovered during reprocessing after v0.4.0 deploy — a document hit a constraint violation and there was no way to identify it from the UI. The document ID is already stored and copyable in the list (from #116) but the failure details are invisible.