feat(users): per-user signing-email override (login ≠ signing identity)

Adds nullable user_profiles.signing_email — the address representing a user
in SIGNING contexts only (EOI developer/approver signer slot, in-CRM 'your
turn to sign' notification, 'awaiting my signature' hub tab). Never a login
credential; better-auth identity stays single-email. NULL → user signs as
their own login email.

Lets a person who logs in as e.g. abbie@ sign on behalf of a shared role
mailbox (sales@) without changing their login. Additive + backward-compatible:
every existing user (NULL override) is byte-for-byte unaffected.

- migration 0100 + drizzle column (nullable, no unique constraint)
- resolveCrmUser: signing_email ?? user.email
- listDocuments hub filter: match the caller's owned email SET (login +
  override) for awaiting_me / awaiting_them (currentUserEmail -> currentUserEmails)
- ctx.user.signingEmail surfaced from the already-loaded profile (no extra query)
- updateUser persists/lowercases the override; '' clears it (edit-only)
- admin Edit-User form: optional 'Signing email' field
- TDD: validator unit test + 3 integration tests (resolver override+fallback,
  updateUser persist/clear, hub awaiting_me matches override)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L2qc3xZTfif7N4Wq3QDa8X

tests/integration/update-user-signing-email.test.ts

@@ -0,0 +1,77 @@
+/**
+ * updateUser persists the optional signing-identity override
+ * (user_profiles.signing_email): lowercased on the way in, and cleared to NULL
+ * when an empty string is supplied.
+ */
+import { afterAll, describe, expect, it, vi } from 'vitest';
+import { eq } from 'drizzle-orm';
+
+import { db } from '@/lib/db';
+import { account, roles, user, userProfiles } from '@/lib/db/schema';
+import { auth } from '@/lib/auth';
+import { createUser, updateUser } from '@/lib/services/users.service';
+import { makePort, makeAuditMeta } from '../helpers/factories';
+
+describe('updateUser - signing_email override', () => {
+  const createdUserIds: string[] = [];
+
+  afterAll(async () => {
+    for (const id of createdUserIds) {
+      await db.delete(account).where(eq(account.userId, id));
+      await db.delete(userProfiles).where(eq(userProfiles.userId, id));
+      await db.delete(user).where(eq(user.id, id));
+    }
+  });
+
+  async function makeUser(): Promise<{ userId: string; portId: string }> {
+    const resetSpy = vi
+      .spyOn(auth.api, 'requestPasswordReset')
+      .mockResolvedValue({ status: true } as never);
+    try {
+      const port = await makePort();
+      const role = await db.query.roles.findFirst({ where: eq(roles.name, 'sales_manager') });
+      if (!role) throw new Error('sales_manager role not seeded');
+      const created = await createUser(
+        port.id,
+        {
+          email: `signemail-${Date.now()}-${Math.random().toString(36).slice(2, 6)}@example.test`,
+          name: 'Abbie May',
+          displayName: 'Abbie May',
+          roleId: role.id,
+          sendSetupEmail: true,
+          residentialAccess: false,
+        },
+        makeAuditMeta(),
+      );
+      createdUserIds.push(created.userId);
+      return { userId: created.userId, portId: port.id };
+    } finally {
+      resetSpy.mockRestore();
+    }
+  }
+
+  async function readSigningEmail(userId: string): Promise<string | null> {
+    const row = await db.query.userProfiles.findFirst({
+      where: eq(userProfiles.userId, userId),
+    });
+    return row?.signingEmail ?? null;
+  }
+
+  it('persists a signing email, lowercased', async () => {
+    const { userId, portId } = await makeUser();
+
+    await updateUser(userId, portId, { signingEmail: 'SALES@PortNimara.com' }, makeAuditMeta());
+
+    expect(await readSigningEmail(userId)).toBe('sales@portnimara.com');
+  });
+
+  it('clears the override when an empty string is supplied', async () => {
+    const { userId, portId } = await makeUser();
+    await updateUser(userId, portId, { signingEmail: 'sales@portnimara.com' }, makeAuditMeta());
+    expect(await readSigningEmail(userId)).toBe('sales@portnimara.com');
+
+    await updateUser(userId, portId, { signingEmail: '' }, makeAuditMeta());
+
+    expect(await readSigningEmail(userId)).toBeNull();
+  });
+});