feat(documenso): rejection reason + poll fallback + rollback hardening + recipient UX

Documenso reliability + signer-UX bundle from the 2026-05-26 live UAT.
Each piece detailed in docs/superpowers/audits/active-uat.md with full
file:line + root cause + alternatives.

Webhook + poll convergence
- DocumensoRecipient (webhook payload type) gains rejectionReason +
  declineReason. The DOCUMENT_REJECTED / DOCUMENT_DECLINED handler
  coalesces them at the boundary so downstream code sees one stable
  field. Empty/whitespace normalised to null.
- DocumensoDocument.recipients[] (normalized client output) gains
  rejectionReason. normalizeDocument coalesces v2 + v1 field names the
  same way so poller consumers see identical shape.
- handleDocumentRejected signature gains rejectionReason. Stored on
  document_events.eventData, persisted in audit_logs metadata, quoted
  inline in the in-CRM rep notification (truncated 120 chars; full
  reason still on the audit row). New 'transfer' AuditAction added
  alongside.
- signature-poll job now handles REJECTED / DECLINED. Previously only
  SIGNED / COMPLETED / EXPIRED were reconciled, so a missed rejection
  webhook (stale tunnel URL is the typical dev cause) left documents
  stuck in 'sent' forever. The 5-min poll cycle now closes that gap —
  webhook becomes an optimisation, not a correctness requirement.

placeFields rollback gap
- custom-document-upload.service moved the synchronous field-placement
  map() INSIDE the same try/catch that wraps placeFields(). Previously
  the map's throw bubbled past the catch-and-rollback block, leaving
  Documenso with a live envelope + recipients but no fields, and the
  CRM document row stuck in 'sent' with no signing UI for the signers.
  Logger captures looked-up email + map keys on miss for diagnosis.
- Comment documents Documenso's by-email dedupe semantic so future
  readers don't reintroduce the per-recipient-row map assumption.

UploadForSigningDialog recipient UX
- New RECIPIENT_ROLE_META + RecipientRoleBadge helpers. Placement-step
  sidebar list rebuilt as a two-line layout (name + role badge / email
  on its own line) so duplicate-named recipients are visually
  distinguishable. FieldSidePanel dropdown SelectItem mirrors the same
  stacked shape.
- "Recipient" label renamed to "Assign this field to" with an explainer
  paragraph below.

SigningProgress copy-link parity
- Copy-link button now always renders for pending signers (disabled +
  explainer tooltip when signingUrl not yet issued). Reps can copy
  even when the URL hasn't been distributed via email yet.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/services/custom-document-upload.service.ts

@@ -414,32 +414,57 @@ export async function uploadDocumentForSigning(
 
   // Build email→recipientId map. v2 envelope create returns empty
   // recipients; distribute fills them in. v1 already has them on create.
+  // Note: Documenso de-dupes by email at the envelope level, so multiple
+  // CRM-side Recipient rows that share an email all map to the same
+  // Documenso recipientId. That's fine for field placement — both rows
+  // simply target the same Documenso recipient.
   const emailToRecipientId = new Map<string, string>();
   for (const dr of sentDoc.recipients) {
     if (dr.email) emailToRecipientId.set(dr.email.toLowerCase(), dr.id);
   }
 
-  // Place fields (skipped silently when empty - but we validated above).
-  const placements: DocumensoFieldPlacement[] = fields.map((f) => {
-    const recipient = recipients[f.recipientIndex]!;
-    const recipientId = emailToRecipientId.get(recipient.email.toLowerCase());
-    if (!recipientId) {
-      throw new ConflictError(
-        `Documenso response missing recipientId for ${recipient.email} - cannot place fields`,
-      );
-    }
-    return {
-      recipientId,
-      type: f.type,
-      pageNumber: f.pageNumber,
-      pageX: f.pageX,
-      pageY: f.pageY,
-      pageWidth: f.pageWidth,
-      pageHeight: f.pageHeight,
-      ...(f.fieldMeta ? { fieldMeta: f.fieldMeta } : {}),
-    };
-  });
+  // Build placements + place fields inside a SINGLE try/catch so any
+  // failure — including the synchronous `fields.map` throw when a
+  // recipient can't be matched — triggers the rollback path. Previously
+  // the map's throw bubbled past the try-block wrapping `placeFields()`,
+  // leaving Documenso with the live envelope + recipients but no fields,
+  // and the CRM document row stuck in 'sent' with no signing UI for the
+  // signers (UAT 2026-05-26 — "doc displays in Documenso but is missing
+  // all fields").
   try {
+    const placements: DocumensoFieldPlacement[] = fields.map((f) => {
+      const recipient = recipients[f.recipientIndex]!;
+      const recipientId = emailToRecipientId.get(recipient.email.toLowerCase());
+      if (!recipientId) {
+        // Surface the diagnostic state alongside the error so the rep
+        // doesn't have to guess which email failed to match. Logs both
+        // the looked-up email and the keys Documenso DID return so a
+        // future audit can see whether the mismatch is dedupe-related
+        // or a true populate failure.
+        logger.error(
+          {
+            documentId: docRow.id,
+            documensoEnvelopeId: documensoDoc.id,
+            lookedUpEmail: recipient.email,
+            availableEmails: Array.from(emailToRecipientId.keys()),
+          },
+          'Documenso recipient lookup miss during field placement',
+        );
+        throw new ConflictError(
+          `Documenso response missing recipientId for ${recipient.email} - cannot place fields`,
+        );
+      }
+      return {
+        recipientId,
+        type: f.type,
+        pageNumber: f.pageNumber,
+        pageX: f.pageX,
+        pageY: f.pageY,
+        pageWidth: f.pageWidth,
+        pageHeight: f.pageHeight,
+        ...(f.fieldMeta ? { fieldMeta: f.fieldMeta } : {}),
+      };
+    });
     await placeFields(documensoDoc.id, placements, portId);
   } catch (err) {
     await db