Wire CPNI, CALEA, 499-A engagement, and discontinuance to generic eSign

Each handler now pauses for officer signature via the eSign portal
before filing/submitting. esign_completed callback re-dispatches
through standard pipeline with client_approved=true.

- CPNI: officer signs certification before ECFS submission (perjury)
- CALEA SSI: officer signs plan before delivery
- 499-A engagement: replaced custom JWT/email with request_esign()
- Discontinuance: officer signs deactivation letter before USAC email
- job_server: injects client_approved + order_number into order_data

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

scripts/workers/services/cpni_certification.py

@@ -188,7 +188,50 @@ class CPNIFilingHandler(BaseServiceHandler):
             )
             return generated
 
-        # ── 2a. Auto-filing toggle ──────────────────────────────────────
+        # ── 2a. Client eSign gate ──────────────────────────────────────
+        # Officer must sign the CPNI certification before FCC submission
+        # (47 CFR § 64.2009(e) requires officer attestation).
+        client_approved = order_data.get("client_approved", False)
+        if not client_approved:
+            # Upload cert PDF to MinIO for the signing portal preview
+            from scripts.document_gen import MinioStorage
+            storage = MinioStorage()
+            pdf_minio_key = ""
+            for path in generated:
+                if path.endswith(".pdf") and "certification" in path.lower():
+                    remote = f"compliance/{order_number}/{os.path.basename(path)}"
+                    try:
+                        storage.upload_file(path, remote)
+                        pdf_minio_key = remote
+                    except Exception as exc:
+                        logger.warning("MinIO upload failed for %s: %s", path, exc)
+                    break
+
+            # Create eSign record + send signing email
+            try:
+                import psycopg2
+                conn = psycopg2.connect(os.environ.get("DATABASE_URL", ""))
+                from scripts.workers.services.telecom.esign_helper import request_esign
+                request_esign(
+                    conn=conn,
+                    order_number=order_number,
+                    document_type="cpni",
+                    document_title="CPNI Annual Certification",
+                    entity_name=entity.get("legal_name", ""),
+                    customer_email=order_data.get("customer_email") or entity.get("contact_email", ""),
+                    customer_name=order_data.get("customer_name") or entity.get("contact_name", ""),
+                    document_minio_key=pdf_minio_key,
+                    requires_perjury=True,
+                    metadata={"frn": entity.get("frn", ""), "docket": CPNI_DOCKET},
+                )
+                conn.close()
+            except Exception as exc:
+                logger.warning("Could not create CPNI eSign record: %s", exc)
+
+            logger.info("CPNIFilingHandler: paused for client eSign — order %s", order_number)
+            return generated
+
+        # ── 2b. Auto-filing toggle ──────────────────────────────────────
         decision = check_auto_filing(order_data)
         if not decision.may_submit:
             logger.info(