capture client signature before filing signed DOT forms

Forms that legally require the client's signature were not being captured
correctly:

- MCS-150 handler created a perjury e-sign record but then submitted to FMCSA
  anyway, before the client signed. Now it gates submission: request the
  signature, hold, and only file when handle_esign_completed re-dispatches with
  client_approved=True.
- MCS-150 e-sign links were signed with JWT_SECRET/ADMIN_JWT_SECRET, but the
  portal verifies with CUSTOMER_JWT_SECRET, so every link returned "Invalid
  portal link." New shared dot_esign helper signs with CUSTOMER_JWT_SECRET.
- carrier-closeout (final MCS-150 Out of Business) and entity-dissolution
  (Articles of Dissolution + no-lawsuits/liens/judgments attestation) captured
  no signature at all. Both now request a signed attestation before the
  workflow proceeds.
- mc-authority / emergency-temporary-authority now get a correctly labeled
  OP-1 applicant certification instead of an "MCS-150" record.

Also fixes a latent dispatcher bug: order["service_slug"] was never set, so
handlers sharing a class fell back to their default SERVICE_SLUG. This made
entity-dissolution run the carrier-closeout branch and mc-authority/etc. look
like mcs150-update. Now the resolved slug is injected into order_data.

Portal e-sign page now renders the document-specific certification text from
metadata.perjury_text (so the dissolution no-liabilities attestation and OP-1
cert are actually shown to the signer), not just a generic perjury line.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/workers/job_server.py

@@ -1141,6 +1141,14 @@ def handle_process_compliance_service(payload: dict) -> dict:
     if order_number:
         order["order_number"] = order_number
 
+    # Expose the resolved service slug to the handler. Several services share one
+    # handler class (e.g. mc-authority / usdot-reactivation -> MCS150UpdateHandler,
+    # entity-dissolution -> CarrierCloseoutHandler), and they branch on the slug.
+    # Without this, order_data.get("service_slug") is absent and handlers fall back
+    # to their default SERVICE_SLUG, mis-identifying the ordered service.
+    if service_slug:
+        order["service_slug"] = service_slug
+
     # Inject eSign approval flags from payload (set by handle_esign_completed)
     if payload.get("client_approved"):
         order["client_approved"] = True