Wire CPNI, CALEA, 499-A engagement, and discontinuance to generic eSign

Each handler now pauses for officer signature via the eSign portal
before filing/submitting. esign_completed callback re-dispatches
through standard pipeline with client_approved=true.

- CPNI: officer signs certification before ECFS submission (perjury)
- CALEA SSI: officer signs plan before delivery
- 499-A engagement: replaced custom JWT/email with request_esign()
- Discontinuance: officer signs deactivation letter before USAC email
- job_server: injects client_approved + order_number into order_data

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

scripts/workers/services/calea_ssi.py

@@ -167,6 +167,46 @@ class CALEASSIHandler(BaseServiceHandler):
                 except Exception as exc:
                     logger.warning("CALEA SSI PDF conversion failed: %s", exc)
 
+        # ── Client eSign gate ──────────────────────────────────────────
+        # The CALEA SSI plan requires officer signature before delivery.
+        client_approved = order_data.get("client_approved", False)
+        if not client_approved and generated:
+            from scripts.document_gen import MinioStorage
+            storage = MinioStorage()
+            pdf_minio_key = ""
+            for path in generated:
+                if path.endswith(".pdf"):
+                    remote = f"compliance/{order_number}/{os.path.basename(path)}"
+                    try:
+                        storage.upload_file(path, remote)
+                        pdf_minio_key = remote
+                    except Exception as exc:
+                        logger.warning("MinIO upload failed for %s: %s", path, exc)
+                    break
+
+            try:
+                import psycopg2
+                conn = psycopg2.connect(os.environ.get("DATABASE_URL", ""))
+                from scripts.workers.services.telecom.esign_helper import request_esign
+                request_esign(
+                    conn=conn,
+                    order_number=order_number,
+                    document_type="calea",
+                    document_title="CALEA System Security & Integrity Plan",
+                    entity_name=entity.get("legal_name", ""),
+                    customer_email=order_data.get("customer_email") or entity.get("contact_email", ""),
+                    customer_name=order_data.get("customer_name") or entity.get("contact_name", ""),
+                    document_minio_key=pdf_minio_key,
+                    requires_perjury=False,
+                    metadata={"frn": entity.get("frn", "")},
+                )
+                conn.close()
+            except Exception as exc:
+                logger.warning("Could not create CALEA eSign record: %s", exc)
+
+            logger.info("CALEASSIHandler: paused for client eSign — order %s", order_number)
+            return generated
+
         # Persist + schedule annual review
         if entity_id:
             self._persist_calea_state(