feat(cv-import): add bounded model-free Docling extraction

tools/summarizer/tests/test_app.py

@@ -616,6 +616,32 @@ def test_extract_text_rejects_oversized_upload_before_parsing(monkeypatch):
     assert "too large" in response.json()["detail"].lower()
 
 
+def test_document_extraction_returns_structural_evidence_without_changing_legacy(monkeypatch):
+    module = load_app_module(monkeypatch)
+    def child(extension, data, *, document=False):
+        assert extension == ".pdf" and data == b"%PDF-synthetic"
+        assert document is True
+        return {"text": "Engineer", "ocr_used": False, "page_count": 1, "method": "docling-native-pdf-v1", "warnings": ["ocr_disabled"], "blocks": [{"id": "b0001", "text": "Engineer", "kind": "paragraph", "page": 1}]}
+    monkeypatch.setattr(module, "_run_parser_child", child)
+    response = TestClient(module.app).post("/cv-import/extract", files={"file": ("resume.pdf", b"%PDF-synthetic", "application/pdf")})
+    assert response.status_code == 200
+    assert response.json() == {"text": "Engineer", "ocr_used": False, "content_type": "application/pdf", "page_count": 1, "characters": 8, "file_name": "resume.pdf", "method": "docling-native-pdf-v1", "warnings": ["ocr_disabled"], "blocks": [{"id": "b0001", "text": "Engineer", "kind": "paragraph", "page": 1}]}
+
+
+def test_document_extraction_rejects_text_and_signature_spoofing(monkeypatch):
+    module = load_app_module(monkeypatch)
+    monkeypatch.setattr(module, "_run_parser_child", lambda *args, **kwargs: pytest.fail("Invalid upload reached parser"))
+    client = TestClient(module.app)
+    for filename, data in [("resume.txt", b"text"), ("resume.pdf", b"not pdf")]:
+        assert client.post("/cv-import/extract", files={"file": (filename, data)}).status_code == 400
+
+
+def test_document_extraction_requires_service_token(monkeypatch):
+    module = load_app_module(monkeypatch, service_token="secret")
+    response = TestClient(module.app).post("/cv-import/extract", files={"file": ("resume.pdf", b"%PDF-synthetic")})
+    assert response.status_code == 401
+
+
 def test_extract_text_rejects_extension_signature_mismatch(monkeypatch):
     module = load_app_module(monkeypatch)
     client = TestClient(module.app)