QA build: permission-aware document/mail actions, bulk PTP sync update, and document-upload PDF preview fixes

A batch of frontend improvements reached QA, centered on hiding document and mail actions when the user lacks the matching permission, a reworked bulk "Sync to PTP" call to the new payments API, faster and more stable PDF previews on the document-upload screen, and bulk status updates for mail items. It also adds graceful "not found" screens, a wired-up document activity log, and several UI polish fixes.

Several actions (update status, delete mail, delete document, archive) were showing for users who could not actually perform them, and stale or unsupported request shapes were being sent for bulk PTP sync and document activity. The document-upload screen also rendered PDF segment previews slowly and could leave range previews or controls in a broken state, and deep links to deleted documents/mails surfaced raw errors instead of a clear message.

• Users only see actions they are permitted to use (status update, delete, archive), reducing confusion and failed attempts.
• Bulk "Sync to PTP" submits the correct numeric document IDs to the new payments endpoint and refreshes the documents list afterward, with a clear error if nothing is selected.
• Document-upload PDF previews load faster and range previews/controls stay usable.
• Opening a deleted document or mail (e.g. from a notification link) shows a friendly "not found" screen.
• Mail items support bulk status updates, with a single-status shortcut button instead of a modal when only one status applies; the mail-details active tab is now preserved in the URL.

Grounded in the diff/file list (notable individual PRs noted where visible):

• Bulk PTP sync (#665, #674): handleSyncToPtp now maps selections to finite numeric IDs and calls bulkSyncToPtp({ document_ids: ids }); new DocumentIdentifierCandidate typing in ptp.types.ts/ptp.services.ts; mail documents refetched after sync.
• Permission gating: action visibility guarded by change_document_status, delete_mail, delete_document across inbox-actions.ts, mail-actions.ts, document-actions.ts, inbox page, MailDocuments.tsx, drawer actions, and document details.
• Archive handling (#668): ARCHIVE_FOLDER_KEYWORDS/isArchiveFolderName helper hides archive action inside the archived folder; archive button/confirmation + failure toast in InboxGrid.tsx.
• Document-upload PDF (#670, #671): preview render-queue/readiness changes in PdfSegmentPreview and DocumentSegmentsGrid for faster rendering and stable range previews; conditional "Add Range" footer.
• Bulk mail status update: BulkUpdateStatusModal wired in mail contents with single-status shortcut button.
• Activity log (#681): document-activity.tsx now fetches paginated activity with load-more; removed unsupported query params; refreshes after updates.
• New screens: NotFoundDocument.tsx / NotFoundMail.tsx shown on retrieval error.
• Polish: subclient roles loaded with parent entity (resolution), metadata read-only/edit UI clarified, external-link icon on multi-upload button, mail-tab persisted in URL, repeated TruncatedText char-limit refactor. (README.md line changed Readme→TEST — a non-functional marker.)

Medium. Permission-gating touches many action surfaces, so a missing or mis-named permission key could over-hide a control for legitimately authorized users; verify each role still sees the actions it should. The PTP request-shape change depends on the backend accepting { document_ids: [...] }; a mismatch would break bulk sync. PDF preview render-queue changes carry mild regression risk on large/multi-page uploads. Mitigation: this is QA-only, scoped to the frontend, and changes are behind permission checks and existing flows.

• For each role, confirm Update Status / Delete (mail and document) / Archive appear only when the role has the matching permission, and are hidden otherwise.
• Inside the Archived folder, confirm the archive action is hidden; elsewhere confirm archive works and shows a failure toast on error.
• Bulk-select documents and Sync to PTP: verify success, the documents list refreshes, and selecting none shows "No documents selected for sync".
• Document-upload screen: verify PDF segment previews load quickly, range previews render, and Add Range controls stay usable across multi-page files.
• Open a deleted document and a deleted mail (incl. via notification link) and confirm the not-found screens render.
• Mail items: test bulk status update via modal, the single-status shortcut button, and that the mail-details tab persists in the URL on refresh.
• Document details: verify the activity log loads, paginates via load-more, and refreshes after an update.