fix(07-04): restrict /file route to original PDF only (LEGAL-03)

- Remove signedFilePath fallback from /file route
- Route now always serves doc.filePath (unsigned original)
- Signed PDF exclusively available via presigned /download?adt=[token]

teressa-copeland-homes/src/app/api/documents/[id]/file/route.ts

@@ -21,8 +21,8 @@ export async function GET(
   });
   if (!doc || !doc.filePath) return new Response('Not found', { status: 404 });
 
-  // Serve signed PDF for completed documents, original otherwise
-  const relativePath = doc.signedFilePath ?? doc.filePath;
+  // Serve the original unsigned PDF only — see LEGAL-03
+  const relativePath = doc.filePath;
   const filePath = path.join(UPLOADS_BASE, relativePath);
 
   // Path traversal guard — critical security check