feat(api): POST /api/bill/estimate/{id}/sign — JSON signature capture

Adds a new JSON-bodied signature endpoint as a sibling of the
legacy PNG-based prosign/clisign routes. The legacy flow stays
intact: the TeX invoice templates (Bill_tex.cshtml,
Estimate_tex.cshtml) still consume the sign-{billingCode}-{id}.png
files the old endpoints write, and the new endpoint writes to a
distinct /signatures/ tree under UserFilesDirName. A future
migration commit will regenerate PNGs from the JSON payload and
decommission the PNG flow.

Scope
- New Signature entity (Yavsc.Server/Models/Billing/Signature.cs)
  with FK to Estimate, FK to ApplicationUser (Signer), Type
  (Pro/Client) enum, CoordinateMax (default 10_000), int[] Strokes
  (native Npgsql mapping), CapturedAtUtc, FilePath. Multiple
  versions per (EstimateId, Type) are allowed; the controller
  reads the most recent.
- New Estimate.Signatures nav collection (InverseProperty) so the
  composite index covers both sides of the relation.
- New DbSet<Signature> Signatures + composite index
  (EstimateId, Type, CapturedAtUtc DESC) in ApplicationDbContext
  OnModelCreating. DeleteBehavior.Cascade on Estimate deletion
  cleans up signatures automatically.
- New EstimateSignatureFileHelper (Server/Helpers) with
  ReceiveEstimateSignatureAsync(user, estimateId, type, payload).
  Writes a yavsc.signature/v1 JSON envelope to
  UserFilesDirName/{user}/signatures/sign-{type}-{estimateId}-{ticks}.json.
  Quota update lives in the controller, not the helper, because
  the helper has no DbContext access.
- New endpoint POST /api/bill/estimate/{id:long}/sign on
  BillingController. Authz is body-driven (the bearer token is the
  PostIt OAuth client, not the end user, so signerUserId is in
  the JSON body, validated against Estimate.OwnerId/ClientId).
  Returns 201 Created with the new Signature's metadata.

Plumbing
- SignatureSubmission (body type) lives next to BillingController
  in the same file — small enough to keep colocated.
- The legacy prosign/clisign routes are untouched. They keep
  the IFormFile PNG contract; the new endpoint is the JSON
  counterpart.

Tests
- New EstimateSignatureFileHelperTests in Yavsc.Org.Tests
  (8 tests, all green): filename format incl. lowercase type and
  ticks, envelope v1 round-trip (parsed via JsonDocument, not
  text matching), null payload rejected, non-positive
  estimateId rejected. Disk side effects are isolated to a
  per-test temp root via AbstractFileSystemHelpers.UserFilesDirName.
- Yavsc.Org.Tests full suite: 29/29 green.
- PostIt.Tests: 57/57 green (untouched by this commit).
- Builds: Yavsc.Server, Yavsc.Api, Yavsc.Org, Yavsc.Org.Tests
  all compile clean.

Out of scope
- EF migration: the Signatures table doesn't exist in the
  database yet. The migration is intentionally a separate
  commit so the generated SQL can be reviewed against the
  composite index and the int[] column type before it touches
  any prod database. Until the migration lands, the new
  endpoint will 500 on SaveChanges; the [DEV] button in
  PostIt is the only call site, so this is acceptable.
- SignalR handler that opens the signature page on a
  'devis received' push — commit 4.

src/Yavsc.Server/Helpers/EstimateSignatureFileHelper.cs

@@ -0,0 +1,160 @@
+using System;
+using System.IO;
+using System.Security.Claims;
+using System.Text;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Http;
+using Yavsc.Models;
+using Yavsc.Models.Billing;
+using Yavsc.Server.Models.FileSystem;
+namespace Yavsc.Server.Helpers;
+
+/// <summary>
+/// Filesystem counterpart of <see cref="Signature"/>: writes
+/// the wire-format JSON payload next to the user's other files,
+/// under <c>signatures/</c>, and updates the user's disk quota.
+///
+/// This is the JSON counterpart of the legacy
+/// <c>ReceiveProSignatureAsync</c> method, which stored
+/// <c>sign-{billingCode}-{signType}-{estimateId}.png</c> blobs.
+/// We don't reuse that helper because (a) the wire format is no
+/// longer a binary image, (b) there's no <c>billingCode</c> on
+/// a freshly signed estimate in our model, and (c) the legacy
+/// helper takes an <see cref="IFormFile"/> whereas our pipeline
+/// decodes a JSON body upstream of the controller and passes
+/// <see cref="SignaturePadPayload"/> in directly.
+/// </summary>
+public static class EstimateSignatureFileHelper
+{
+    /// <summary>
+    /// Sub-directory under the user's root where signature
+    /// payloads live. Kept short to leave room in PATH_MAX on
+    /// legacy filesystems; the rest of the filename is
+    /// <c>sign-{type}-{estimateId}-{utcTicks}.json</c>.
+    /// </summary>
+    public const string SignaturesSubdir = "signatures";
+
+    /// <summary>
+    /// Format string for signature file names. Public so the
+    /// migration and the admin tools can list by pattern.
+    /// </summary>
+    public static string FileNameFormat(SignatureType type, long estimateId, long utcTicks)
+        => $"sign-{type.ToString().ToLowerInvariant()}-{estimateId}-{utcTicks}.json";
+
+    /// <summary>
+    /// Persist a signature wire payload to disk. Returns the
+    /// file info (relative path under the user's root) suitable
+    /// for storing in <see cref="Signature.FilePath"/>; the
+    /// caller is responsible for the database write.
+    /// </summary>
+    /// <param name="user">Signed-in user. Their
+    /// <c>Identity.Name</c> locates the disk root via
+    /// <see cref="AbstractFileSystemHelpers.UserFilesDirName"/>.
+    /// </param>
+    /// <param name="estimateId">Estimate this signature
+    /// attaches to. Used in the file name for human inspection
+    /// and to support multiple versions over time.</param>
+    /// <param name="type">Provider or client signature.</param>
+    /// <param name="payload">Decoded wire payload (strokes +
+    /// coordinateMax + capturedAtUtc). Already validated
+    /// upstream.</param>
+    /// <param name="token">Cancellation token forwarded to
+    /// the file write.</param>
+    public static async Task<FileReceivedInfo> ReceiveEstimateSignatureAsync(
+        this ClaimsPrincipal user,
+        long estimateId,
+        SignatureType type,
+        SignaturePadPayload payload,
+        CancellationToken token = default)
+    {
+        if (user is null) throw new ArgumentNullException(nameof(user));
+        if (payload is null) throw new ArgumentNullException(nameof(payload));
+        if (estimateId <= 0) throw new ArgumentOutOfRangeException(nameof(estimateId));
+
+        // Ensure the user has a /signatures/ sub-directory we can
+        // write to. EnsureDestinationDirectory throws on invalid
+        // paths and creates the directory on the way; the
+        // SignaturesSubdir constant is a server-controlled value
+        // (not user-derived), so we skip the IsValidYavscPath
+        // check that ReceiveUserFile performs on user-supplied
+        // subpaths.
+        var root = user.EnsureDestinationDirectory(SignaturesSubdir);
+
+        var fileName = FileNameFormat(type, estimateId, DateTime.UtcNow.Ticks);
+        var fullPath = Path.Combine(root, fileName);
+
+        var envelope = new
+        {
+            format = "yavsc.signature/v1",
+            coordinateMax = payload.CoordinateMax,
+            capturedAtUtc = payload.CapturedAtUtc,
+            estimateId,
+            type = type.ToString(),
+            // Identity.Name is the username; we keep the wire
+            // payload keyed on the username rather than the
+            // numeric/guid Id so disk-side human inspection
+            // (e.g. cat sign-pro-1234-...json) is self-evident.
+            signerName = user.Identity?.Name,
+            strokes = payload.Strokes,
+            strokeCount = CountStrokes(payload.Strokes),
+        };
+
+        var json = JsonSerializer.Serialize(envelope, new JsonSerializerOptions { WriteIndented = true });
+        await File.WriteAllTextAsync(fullPath, json, Encoding.UTF8, token).ConfigureAwait(false);
+
+        // Quota update is the controller's responsibility: the
+        // helper has no DbContext access, and a ClaimsPrincipal
+        // is not an ApplicationUser. The controller looks up
+        // the user by Identity.Name and bumps DiskUsage after
+        // a successful database write.
+
+        return new FileReceivedInfo(root, fileName);
+    }
+
+    private static int CountStrokes(int[] strokes)
+    {
+        int n = 0;
+        for (int i = 0; i < strokes.Length;)
+        {
+            int k = strokes[i];
+            if (k <= 0) break;
+            n++;
+            i += 1 + 2 * k;
+        }
+        return n;
+    }
+}
+
+/// <summary>
+/// Wire payload accepted by the signature endpoint and
+/// persisted by <see cref="EstimateSignatureFileHelper"/>.
+/// Mirrors <c>PostIt.Models.SignaturePadData</c>'s JSON shape
+/// (without the disk-only envelope fields) so the two sides
+/// stay trivially compatible.
+/// </summary>
+public class SignaturePadPayload
+{
+    /// <summary>
+    /// Normalised coordinate upper bound. Must be
+    /// <c>PostIt.Models.SignaturePadData.CoordinateMax</c>
+    /// (10_000) today; declared as a property so a future
+    /// resolution change can be replayed against the same
+    /// wire format.
+    /// </summary>
+    public int CoordinateMax { get; set; } = 10_000;
+
+    /// <summary>
+    /// Client-reported capture time. The server may ignore
+    /// this for ordering (UTC now is the truth) but keeps it
+    /// for round-trip display.
+    /// </summary>
+    public DateTime CapturedAtUtc { get; set; }
+
+    /// <summary>
+    /// Wire strokes. See
+    /// <c>PostIt.Models.SignaturePadData</c> for the format.
+    /// </summary>
+    public int[] Strokes { get; set; } = Array.Empty<int>();
+}