feat(indexer): extract Office documents to Markdown with downmark

[giraffesyo]

What

Office documents (.docx, .pptx, .xlsx, and now .doc) extract to Markdown through @giraffesyo/downmark (pure-Go converter compiled to wasm, bundled as a server npm dependency). The Python Office readers are gone. PDFs are unchanged (pdftotext → OCR).

• server/src/preextract.ts — walks the scope, converts stale/missing entries into $INDEX_BASE/extract/<rel>.txt, runs as a forked child (runPreExtract) from indexing.ts before each enrich.py pass, and as a CLI from reindex.sh. Entries refresh once per downmark version (extract/.downmark-version).
• enrich.py reuses the cache as before. python-docx / python-pptx / openpyxl are removed; the standard-library OOXML pass remains as the last resort for a document downmark rejects. .doc added to the extracted suffixes.
• Deploy: the pip/apt lines leave app.def (proof step now checks pdftotext, tesseract, soffice and the downmark wasm); the per-host venv step and its PYTHON_BIN exports leave workflow.yaml (reindex.sh and the server already locate a Python 3.10+); requirements.txt keeps only the optional pypdf.
• Viewer renders the extracted Office text with Streamdown; extractor report lists downmark.

Why

• Office extraction no longer depends on anything on the host — no pip, no venv, no "the apt line silently installed nothing" class of failure.
• Materially better output: pptx tables/charts/notes, docx headings/tables/equations, xlsx as GFM tables — verified against the markitdown fixtures; the old readers dropped all of those.
• Markdown is the better shape for the chat context, FTS snippets and the viewer.

Verified

• pnpm build (server + web) clean; workflow.yaml still parses.
• CLI: full pass converts 4/4; rerun reuses 4/4; touch + --subdir reconverts 1; enrich.py over a fake GUFI tree indexes the Markdown (tables/headings present in words), PDF still via pdftotext.
• runPreExtract fork works under tsx (dev) and from dist/ (prod, incl. pnpm deploy --legacy layout with the wasm).
• Unreadable input (random.bin as .docx) is logged, counted as failed, exit 0; with no cache entry and no python-docx installed, enrich.py's stdlib reader still indexes the document.

Notes

• downmark keeps PDF ligature codepoints (U+FB01…) that FTS5 won't fold — one reason PDFs stay on poppler for now; filed as Type1 /Differences ligature glyphs (fi, fl, ff, ffi, ffl) extract as U+FB00–FB04 instead of ASCII letters giraffesyo/pdf#9.
• reindex.sh needs the built server (server/dist/preextract.js) and node on PATH (NODE_BIN overrides); otherwise it says so and the stdlib reader applies.