fix(integration): webhook v2 events, storage migrate, test theatre

- F1: DOCUMENT_DECLINED handler (v2 Decline vs Reject) — routes to same
  handler as DOCUMENT_REJECTED until product refines downstream UX
- Add RECIPIENT_VIEWED / RECIPIENT_SIGNED v2-alias cases with telemetry
  logging so we see when v2 deployments emit them
- D1: populate TABLES_WITH_STORAGE_KEYS (files, berth_pdf_versions,
  brochure_versions, gdpr_exports) — was an empty list, migrated 0 files
- MinIO putObject/getObject/statObject/removeObject socket timeout wrapper
  to prevent worker hangs on TCP blackhole (30s deadline)
- E1: convert test.skip on smoke-setup infra failure to throw new Error
  so green-skipped silence becomes a real test failure (Playwright
  doesn't expose vitest's expect.fail)
- Regression tests: folderId='' → null transform, applyEntityRestoredSuffix
  no-op (never-archived), syncEntityFolderName collision loop past (2)

Note: matching .env.example documentation (D2 — bare DOCUMENSO_API_URL,
DOCUMENSO_API_VERSION, MINIO_AUTO_CREATE_BUCKET, DOCUMENSO_TEMPLATE_ID_EOI,
recipient role id vars) prepared but not committed — pre-commit hook
blocks .env*. Apply manually via the separate .env workflow.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/storage/migrate.ts

@@ -32,14 +32,31 @@ export interface StorageKeyTable {
 }
 
 /**
- * Phase 6a ships an empty list — `berth_pdf_versions` and `brochure_versions`
- * land in Phase 6b. Add new entries here when new file-bearing tables are
- * introduced. The migration script reads each named table via raw SQL so it
- * does not need to import every domain's Drizzle schema.
+ * Tables that hold blob references the migration script must walk.
+ *
+ * Column naming is intentionally inconsistent across the schema for historical
+ * reasons:
+ *   - `files.storage_path`             (oldest table, named before §4.7a rename)
+ *   - `berth_pdf_versions.storage_key` (Phase 6b — followed the new convention)
+ *   - `brochure_versions.storage_key`  (Phase 6b)
+ *   - `gdpr_exports.storage_key`       (worker-uploaded export bundle)
+ *
+ * None of these tables carry a per-row content-type column today
+ * (`files.mime_type` exists but isn't the same semantics — it's the
+ * original-upload mime, not the stored object's Content-Type header). The
+ * migration falls back to `application/octet-stream` when
+ * `contentTypeColumn` is omitted; the byte stream is what matters for the
+ * sha256-verified round-trip and the original Content-Type is already
+ * persisted on the source object's S3 metadata.
+ *
+ * The `report_snapshots` table called out in the audit does not exist yet.
+ * Add it here when it lands.
  */
 export const TABLES_WITH_STORAGE_KEYS: StorageKeyTable[] = [
-  // { table: 'berth_pdf_versions', keyColumn: 'storage_key', pkColumn: 'id', contentTypeColumn: 'content_type' },
-  // { table: 'brochure_versions',  keyColumn: 'storage_key', pkColumn: 'id', contentTypeColumn: 'content_type' },
+  { table: 'files', keyColumn: 'storage_path', pkColumn: 'id' },
+  { table: 'berth_pdf_versions', keyColumn: 'storage_key', pkColumn: 'id' },
+  { table: 'brochure_versions', keyColumn: 'storage_key', pkColumn: 'id' },
+  { table: 'gdpr_exports', keyColumn: 'storage_key', pkColumn: 'id' },
 ];
 
 const ADVISORY_LOCK_KEY = 0xc7000a01;