Add a containerized .docx redaction service to Philter, using the Philter Desktop method

[jzonthemtn]

Scope: a new service repository (to be named, e.g. philter-docx-service) for the service itself, plus philterd/philter for the docker-compose wiring. The service should reuse the .docx method already implemented in philterd/PhilterDesktop (with detection from philterd/phileas-dotnet) rather than reimplementing it.

Context

Philter (the server) does not currently redact .docx files. Philter Desktop does, using the .NET Open XML SDK (DocumentFormat.OpenXml) to read and edit the Word document and phileas-dotnet for detection (the local PhEye/GLiNER model plus pattern filters). It also strips hidden channels (document metadata, comments) so a redacted copy does not leak through them.

Packaging that capability as a service lets a Philter server deployment redact .docx too, closing the gap. Among other things, it makes the proposed "Send to Philter server" connector work for Word documents.

Proposal

Create a small service that:

• Accepts a .docx file and a redaction policy, applies the same redaction method as Philter Desktop (Open XML SDK for the document content and hidden-channel handling, phileas-dotnet for detection), and returns a redacted .docx.
• Ships as a Docker image and is added to Philter's docker-compose alongside the existing services (Philter, PhEye, MongoDB, Valkey).
• Is reachable by Philter so the server can hand off .docx documents to it (similar to how Philter calls PhEye) and return the redacted result through the normal Philter flow.

To avoid two diverging .docx implementations, factor the shared redaction pipeline into a reusable .NET library used by both Philter Desktop and this service.

Acceptance Criteria

• A service accepts a .docx plus a redaction policy and returns a redacted .docx, producing the same result as Philter Desktop for the same input and policy.
• Detection uses the same engine and method as Philter Desktop (phileas-dotnet; local model and pattern filters).
• The redacted output handles the document's hidden channels (metadata, comments, and similar) consistently with Philter Desktop.
• The service is published as a Docker image and added to Philter's docker-compose.
• Philter can route/delegate .docx documents to the service and return the redacted result through its normal API flow (or the integration path is documented).
• The .docx redaction pipeline is shared with Philter Desktop, with no duplicated, divergent implementation.
• Documentation covers deploying the service via docker-compose and how Philter uses it.