feat(inbox): two-stage upload front-end — text formats (stage 2a)

Realistic-upload showcase (PLAN §247), first slice. A stage-1 front-end reads
dropped files and materializes them into an OKF bundle {concept_path: text} +
provenance; receive() wires extract -> import_bundle -> verdict. This slice
covers .txt/.md (stdlib only); .zip/.csv/folder/.docx/.pptx follow.

- Front-end lives in tests/ (showcase/dev-scoped), core stays stdlib-only:
  dependencies=[] untouched; python-docx/python-pptx added to the [dev] extra
  (used from stage 2d/2e), never a public [extract] extra (not v1 per PLAN).
- .txt injection -> guard T1 -> REJECT; clean .txt -> ADMIT; a dropped .md keeps
  its frontmatter so a dangerous value -> T2 REJECT; an index.* upload
  materializes onto the reserved uploads/index.md -> T4 REJECT.
- Detach-proof: neuter extraction to an empty bundle -> the poisoned upload
  ADMITs, proving the verdict depends on extraction carrying the payload.

Tests 282 -> 288.

pyproject.toml

@@ -23,7 +23,11 @@ dependencies = []  # stdlib-only core — see design principle 1
 [project.optional-dependencies]
 ml = []            # pluggable embedding/classifier detectors (placeholder)
 judge = []         # LLM-judge / source-grounding implementation (placeholder)
-dev = ["pytest>=8"]
+# Showcase-only extraction parsers for the two-stage OKF inbox demo (docs/PLAN.md
+# §247). Deliberately in `dev`, NOT the core `dependencies` (which stays []) and
+# NOT a public `[extract]` extra — the front-end is an in-repo demonstration, not
+# v1 shipped code. They pull lxml/Pillow transitively; that footprint is dev-only.
+dev = ["pytest>=8", "python-docx>=1.2", "python-pptx>=1.0"]
 
 [tool.hatch.build.targets.wheel]
 packages = ["src/llm_ingestion_guard"]