fix(documents): idempotency, perf, contract pipeline, observability

- A1: idempotency gate in handleDocumentCompleted (prevents duplicate files on Documenso retry)
- A3: LEFT JOIN port_id move to outer WHERE (uses idx_docs_signed_file_id)
- G-C5: contract_sent / contract_signed auto-advance triggers in sendDocument + handleDocumentCompleted
- 0-byte signed PDF guard before storage.put
- portId in outer catch + poll worker
- Sanitize storagePath/storageBucket in aggregated files API
- Audit log for handleDocumentCompleted file insert
- Replace em-dashes in aggregated group labels with colons
- G-I6: delete orphaned hub-counts route + getHubTabCounts service fn

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/error-codes.ts

@@ -172,6 +172,12 @@ export const ERROR_CODES = {
     status: 404,
     userMessage: 'That document template is missing or has been removed.',
   },
+  DOCUMENSO_EMPTY_PDF: {
+    status: 502,
+    userMessage:
+      'The signing service returned an empty PDF. Please retry, and if it keeps happening, ping an admin.',
+    hint: 'Documenso downloadSignedPdf returned a 0-byte buffer; do not persist as signedFileId.',
+  },
 
   // ─── Send-outs / Email ──────────────────────────────────────────────
   EMAIL_RECIPIENT_MISSING: {