fix(eoi): uppercase Documenso recipient roles at the API boundary

The local-fill EOI pathway passed lowercase roles ('signer'/'approver') to
createDocument; Documenso's API requires UPPERCASE (CC|SIGNER|VIEWER|APPROVER|
ASSISTANT) and rejected them with a 400 "Invalid enum value", surfacing as a
502 DOCUMENSO_UPSTREAM_ERROR on generate. Normalize role to uppercase where
safeRecipients is built so both v1 + v2 paths and all callers are covered.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/lib/services/documenso-client.ts

@@ -309,7 +309,14 @@ export async function createDocument(
   portId?: string,
   meta?: CreateDocumentMeta,
 ): Promise<DocumensoDocument> {
-  const safeRecipients = applyRecipientRedirect(recipients);
+  // Documenso's API requires UPPERCASE recipient roles
+  // (CC | SIGNER | VIEWER | APPROVER | ASSISTANT). The CRM uses lowercase
+  // role strings internally ('signer' / 'approver'), so normalize here at the
+  // API boundary — otherwise create fails with a 400 "Invalid enum value".
+  const safeRecipients = applyRecipientRedirect(recipients).map((r) => ({
+    ...r,
+    role: typeof r.role === 'string' ? r.role.toUpperCase() : r.role,
+  }));
   if (env.EMAIL_REDIRECT_TO) {
     logger.info(
       { redirected: safeRecipients.length, original: recipients.map((r) => r.email) },