fix(documents): idempotency, perf, contract pipeline, observability

- A1: idempotency gate in handleDocumentCompleted (prevents duplicate files on Documenso retry)
- A3: LEFT JOIN port_id move to outer WHERE (uses idx_docs_signed_file_id)
- G-C5: contract_sent / contract_signed auto-advance triggers in sendDocument + handleDocumentCompleted
- 0-byte signed PDF guard before storage.put
- portId in outer catch + poll worker
- Sanitize storagePath/storageBucket in aggregated files API
- Audit log for handleDocumentCompleted file insert
- Replace em-dashes in aggregated group labels with colons
- G-I6: delete orphaned hub-counts route + getHubTabCounts service fn

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/app/api/v1/documents/hub-counts/route.ts

@@ -1,16 +0,0 @@
-import { NextResponse } from 'next/server';
-
-import { withAuth, withPermission } from '@/lib/api/helpers';
-import { errorResponse } from '@/lib/errors';
-import { getHubTabCounts } from '@/lib/services/documents.service';
-
-export const GET = withAuth(
-  withPermission('documents', 'view', async (_req, ctx) => {
-    try {
-      const counts = await getHubTabCounts(ctx.portId, ctx.user.email);
-      return NextResponse.json({ data: counts });
-    } catch (error) {
-      return errorResponse(error);
-    }
-  }),
-);