Make the governed RAG evidence path executable end to end

Separate local parsing from model indexing, bind review decisions to immutable manifests, persist vectors behind active profiles, and expose retrieval, chat, evaluation, and document workflows through the React workbench.

Constraint: Live Bailian authentication currently fails for all three configured capabilities

Rejected: Direct upload-to-embedding flow | bypasses local review and manifest binding

Confidence: high

Scope-risk: broad

Directive: Keep private-data deployment blocked until authentication, RBAC, and separate database roles land

Tested: make verify; fresh and replay Docker document smoke; worker recovery smoke; frozen synthetic evaluation; migration 0003-0004 roundtrip

Not-tested: Successful live Bailian calls, OCR, real multi-user authorization

backend/app/main.py

@@ -1,15 +1,20 @@
 """FastAPI application factory and production entrypoint."""
 
-from typing import Any
+from typing import Any, cast
 
 import psycopg
 import uvicorn
 from fastapi import FastAPI, Response, status
+from fastapi.exceptions import RequestValidationError
 
 from app import __version__
-from app.api.v1 import demo_router
+from app.api.v1 import chat_router, demo_router, documents_router, retrieval_router
 from app.core.config import get_settings
-from app.core.problems import ApiProblem, api_problem_handler
+from app.core.problems import (
+    ApiProblem,
+    api_problem_handler,
+    request_validation_problem_handler,
+)
 from app.core.request_context import trace_request
 from app.core.secrets import SecretFileError
 
@@ -63,11 +68,30 @@ def create_app() -> FastAPI:
             {"name": "health", "description": "Process and database health probes."},
             {"name": "meta", "description": "Safe runtime capability metadata."},
             {"name": "offline-demo", "description": "Synthetic offline validation only."},
+            {
+                "name": "retrieval",
+                "description": "Profile-aware authorized vector retrieval and reranking.",
+            },
+            {
+                "name": "chat",
+                "description": "Evidence-grounded answers with validated citation events.",
+            },
+            {
+                "name": "documents",
+                "description": "Governed uploads, asynchronous processing, and review bundles.",
+            },
         ],
     )
     api.middleware("http")(trace_request)
     api.add_exception_handler(ApiProblem, api_problem_handler)  # type: ignore[arg-type]
+    api.add_exception_handler(
+        RequestValidationError,
+        cast(Any, request_validation_problem_handler),
+    )
     api.include_router(demo_router)
+    api.include_router(retrieval_router)
+    api.include_router(chat_router)
+    api.include_router(documents_router)
     api.add_api_route(
         "/health/live",
         live,