feat(documents): hub page with tabs, filters, and live counts

Replaces /documents with the Phase A hub: tabs (All/Awaiting them/
Awaiting me/Completed/Expired) backed by per-tab counts via a new
hub-counts endpoint, signature-only chip, type filter, expandable
signer rows, and real-time invalidation across the eight document
socket events. listDocuments grew tab/watcher/signatureOnly/sent-window
filters; the legacy file browser moved to /documents/files where the
sidebar already linked.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/validators/documents.ts

@@ -17,11 +17,31 @@ export const updateDocumentSchema = z.object({
   status: z.enum(DOCUMENT_STATUSES).optional(),
 });
 
+export const documentsHubTabs = [
+  'all',
+  'awaiting_them',
+  'awaiting_me',
+  'completed',
+  'expired',
+] as const;
+export type DocumentsHubTab = (typeof documentsHubTabs)[number];
+
 export const listDocumentsSchema = baseListQuerySchema.extend({
   interestId: z.string().optional(),
   clientId: z.string().optional(),
   documentType: z.string().optional(),
   status: z.string().optional(),
+  /** Hub tab filter — applies tab-specific status / signer-membership constraints. */
+  tab: z.enum(documentsHubTabs).optional(),
+  /** Restrict to docs being watched by this user id. */
+  watcherUserId: z.string().optional(),
+  /** When true, only docs intended for signing (default true on hub). */
+  signatureOnly: z
+    .enum(['true', 'false'])
+    .optional()
+    .transform((v) => (v === undefined ? undefined : v === 'true')),
+  sentSince: z.string().datetime().optional(),
+  sentUntil: z.string().datetime().optional(),
 });
 
 export const uploadSignedSchema = z.object({