fix(portal): serve signed PDF in viewer after document is signed

When signedFilePath is set, /api/documents/[id]/file now returns the
signed PDF so agent sees embedded signatures and initials in the portal
viewer. Falls back to original PDF when not yet signed.

teressa-copeland-homes/src/app/api/documents/[id]/file/route.ts

@@ -21,8 +21,9 @@ export async function GET(
   });
   if (!doc || !doc.filePath) return new Response('Not found', { status: 404 });
 
-  // Serve the original unsigned PDF only — see LEGAL-03
-  const relativePath = doc.filePath;
+  // Serve signed PDF to agent when available (LEGAL-03 applies to client-facing endpoints only)
+  // Fall back to original if not yet signed
+  const relativePath = doc.signedFilePath ?? doc.filePath;
   const filePath = path.join(UPLOADS_BASE, relativePath);
 
   // Path traversal guard — critical security check