trucking: stamp e-signature exactly on form signature lines + state authorization gate

Capture-to-form signature placement so the customer's drawn or typed
signature lands right on the signature rule of the actual form, not in a
sidecar page.

- migration 085: esign_records.signature_anchors (JSONB exact PDF coords,
  lower-left origin, points) + signed_document_minio_key
- signature_stamper.py: signature_box() anchors; anchors_from_acroform()
  pulls the signature field /Rect from a real AcroForm (e.g. MCS-150
  certifySignature); stamp_signature() overlays PNG (auto-trimmed so ink
  rests on the rule) or typed name, scaled to actual page size
- state_trucking_authorization.py: renders the Limited Authorization to
  File PDF and returns (pdf_bytes, anchors)
- esign_stamp.py: stamp_esign_document() downloads unsigned PDF, stamps,
  uploads _signed.pdf, sets signed_document_minio_key (idempotent)
- dot_esign.py: extract certifySignature anchor for MCS-150/closeout forms
  so the federal perjury cert is signed on the line
- state_trucking.py: authorization gate — first run emails signing link
  and PAUSES; resumes with client_approved after signing
- job_server handle_esign_completed: stamp then re-dispatch
- tests: test_signature_placement.py (custom form), and
  test_mcs150_signature_placement.py (official AcroForm) both assert the
  signature lands inside the recorded signature box (verified visually)

api/migrations/085_esign_signature_anchors.sql

@@ -0,0 +1,32 @@
+-- 085: Precise signature placement for e-signed documents.
+--
+-- Requirement: the client's drawn/typed signature must land exactly on the
+-- signature line of the generated form, not in a generic "signed" sidecar.
+--
+-- When a document generator draws a signature line, it records the exact
+-- PDF coordinates of each signature box in `signature_anchors`. At sign time
+-- the stamper composites the signature PNG onto those coordinates and writes
+-- the flattened, signed PDF to `signed_document_minio_key`.
+--
+-- signature_anchors shape (array, one entry per place a signature goes):
+--   [
+--     {
+--       "field":  "signer",          -- which signature this box expects
+--       "page":   0,                 -- 0-based page index
+--       "x":      72.0,              -- lower-left x of the box, in PDF points
+--       "y":      120.0,             -- lower-left y of the box, in PDF points
+--       "w":      216.0,             -- box width  in points
+--       "h":      40.0,              -- box height in points
+--       "page_w": 612.0,            -- page width  the coordinates were authored against
+--       "page_h": 792.0             -- page height the coordinates were authored against
+--     }
+--   ]
+
+ALTER TABLE esign_records
+    ADD COLUMN IF NOT EXISTS signature_anchors      JSONB,
+    ADD COLUMN IF NOT EXISTS signed_document_minio_key TEXT;
+
+COMMENT ON COLUMN esign_records.signature_anchors IS
+    'Exact PDF coordinates of each signature box, recorded by the document generator so the stamper can place the signature on the signature line.';
+COMMENT ON COLUMN esign_records.signed_document_minio_key IS
+    'MinIO key of the flattened PDF with the signature stamped onto the signature line.';