trucking: stamp e-signature exactly on form signature lines + state authorization gate

Capture-to-form signature placement so the customer's drawn or typed
signature lands right on the signature rule of the actual form, not in a
sidecar page.

- migration 085: esign_records.signature_anchors (JSONB exact PDF coords,
  lower-left origin, points) + signed_document_minio_key
- signature_stamper.py: signature_box() anchors; anchors_from_acroform()
  pulls the signature field /Rect from a real AcroForm (e.g. MCS-150
  certifySignature); stamp_signature() overlays PNG (auto-trimmed so ink
  rests on the rule) or typed name, scaled to actual page size
- state_trucking_authorization.py: renders the Limited Authorization to
  File PDF and returns (pdf_bytes, anchors)
- esign_stamp.py: stamp_esign_document() downloads unsigned PDF, stamps,
  uploads _signed.pdf, sets signed_document_minio_key (idempotent)
- dot_esign.py: extract certifySignature anchor for MCS-150/closeout forms
  so the federal perjury cert is signed on the line
- state_trucking.py: authorization gate — first run emails signing link
  and PAUSES; resumes with client_approved after signing
- job_server handle_esign_completed: stamp then re-dispatch
- tests: test_signature_placement.py (custom form), and
  test_mcs150_signature_placement.py (official AcroForm) both assert the
  signature lands inside the recorded signature box (verified visually)

scripts/workers/job_server.py

@@ -1635,6 +1635,21 @@ def handle_esign_completed(payload: dict) -> dict:
 
     LOG.info("[esign_completed] Signature received for %s (type=%s)", order_number, document_type)
 
+    # Stamp the captured signature onto the signature line of the form PDF, so
+    # the signed document carries the client's signature exactly where it
+    # belongs (see services/signature_stamper.py). Non-fatal on failure — the
+    # signature is still recorded in esign_records.
+    esign_record_id = payload.get("esign_record_id")
+    if esign_record_id:
+        try:
+            from scripts.workers.services.esign_stamp import stamp_esign_document
+            signed_key = stamp_esign_document(int(esign_record_id))
+            if signed_key:
+                LOG.info("[esign_completed] Signed form stamped for %s -> %s", order_number, signed_key)
+        except Exception as exc:
+            LOG.warning("[esign_completed] Signature stamp failed for %s: %s", order_number, exc)
+
+
     try:
         import psycopg2
         conn = psycopg2.connect(os.environ.get("DATABASE_URL", ""))