feat: add admin announcements management and API documentation

[chenyme]

Summary

Add a site announcement system for signed-in users and admin management.

Admins can create, edit, enable/disable, delete, prioritize, pin, and classify Markdown announcements. Signed-in users see active announcements in a grouped dialog with sorting by default order, type, or time. Announcement state is persisted per user and announcement version: closing an announcement marks the current version as read, while “today do not show” suppresses it only until the next day.

Change type

• Bug fix
• Feature
• Documentation
• Refactor
• Configuration / deployment
• Security hardening
• Other

Affected areas

• Frontend / UI
• Backend / API
• Authentication / authorization
• Conversations / streaming
• Files / RAG / extraction
• Model routing / providers
• MCP / tools
• Billing / payments
• Admin console
• Deployment / Docker / configuration
• Documentation

Verification

• cd backend && go test ./internal/application/announcement/... ./internal/infra/persistence/postgres/announcement/... ./internal/infra/persistence/models
• cd backend && make swagger
• cd frontend && pnpm lint
• cd frontend && pnpm build

Screenshots, API examples, or logs

UI changes include the admin announcement management page and the signed-in user announcement dialog.

New/updated API endpoints:

• GET /api/v1/announcements
• POST /api/v1/announcements/{id}/dismiss-today
• POST /api/v1/announcements/{id}/close
• GET /api/v1/admin/announcements
• POST /api/v1/admin/announcements
• PATCH /api/v1/admin/announcements/{id}
• DELETE /api/v1/admin/announcements/{id}

Configuration, migration, and compatibility notes

Adds announcement persistence tables and fields through the existing startup migration path:

• system_announcements
• announcement_user_states
• announcement fields including type, pinned
• per-user announcement state fields including dismissed_until, closed_at

Announcement user state is versioned by announcement_updated_at, so updated announcements are shown again even if a previous version was closed.

Swagger docs were regenerated.

Documentation

• Documentation is not needed for this change.
• Documentation was updated.
• Documentation still needs to be updated.

Security and privacy

• No secrets, tokens, credentials, local config, or personal data are included.
• User data access remains scoped by authenticated user context unless an admin-only path explicitly requires broader access.
• Security-sensitive behavior was reviewed, including authentication, authorization, provider routing, file processing, billing, and admin APIs where relevant.

Checklist

• I searched existing issues and pull requests.
• Changes are focused and do not include unrelated refactors.
• Tests or static verification were run where practical.
• User-facing behavior, deployment steps, API contracts, or configuration changes are documented.
• Generated artifacts are included only when this project explicitly requires them.
• Caches, build output, .pyc files, .env files, and local storage data are not committed.