fix(05-04): reject field updates when document status is not Draft

teressa-copeland-homes/src/app/api/documents/[id]/fields/route.ts

@@ -26,6 +26,11 @@ export async function PUT(
   if (!session) return new Response('Unauthorized', { status: 401 });
 
   const { id } = await params;
+
+  const doc = await db.query.documents.findFirst({ where: eq(documents.id, id) });
+  if (!doc) return Response.json({ error: 'Not found' }, { status: 404 });
+  if (doc.status !== 'Draft') return Response.json({ error: 'Document is locked' }, { status: 403 });
+
   const fields: SignatureFieldData[] = await req.json();
 
   const [updated] = await db