feat(document-infrastructure): add generic document registry, versioning, classification, evidence, and numbering sequences #751

Parent epic: #738
Depends on: #739
Admission requirement: apply docs/awcms-mini/21_module_admission_governance.md before implementation.

Context

Many derived applications need reusable document metadata, versions, classifications, evidence/attachments, resource relations, retention references, and concurrency-safe numbering. The base must provide infrastructure only; it must not embed domain documents such as letters, invoices, purchase orders, journal batches, medical records, or contracts.

Objective

Add an optional generic document-infrastructure capability with immutable versions, classification, evidence links, generic resource references, access/audit controls, and scoped numbering sequences.

Scope

• Complete module-admission decision/ADR before scaffold.
• Define generic document metadata with stable ID, tenant, owner module, document type/classification reference, status, title/summary, issued/effective dates, confidentiality level, retention reference, and generic resource relation.
• Add immutable document versions with content/file references, media type, size, checksum, source, created-by, and supersession metadata.
• Reuse existing/approved managed-object storage contracts rather than storing large binary content in PostgreSQL.
• Add typed relationships between documents and module-owned resources through generic references/capability validation, not direct table writes.
• Add evidence records for reserved/canceled/replaced/voided versions or numbers.
• Add concurrency-safe numbering sequences with:
  • scope type/ID;
  • format/prefix/suffix rules using a bounded template grammar;
  • reset policies;
  • reservation, commit, cancel, and gap evidence;
  • effective dates/versioning;
  • no silent number reuse.
• Add permission-gated APIs/UI for document registry, versions, relations, classifications, number sequences, reservations, canceled numbers, and history.
• Integrate retention/legal hold through feat(data-lifecycle): add retention, partitioning, archival, legal-hold, and safe purge foundations #745 when available; avoid duplicating lifecycle engines.
• Integrate workflow/event capabilities through feat(workflow): add managed definitions, conditional routing, delegation, escalation, quorum, and approval inbox #747/feat(domain-events): add transactional event outbox, idempotent consumers, retries, ordering, and dead-letter handling #742 when available without hard dependencies unless admitted.
• Add metrics for version creation, sequence contention, reservations, canceled/gap evidence, and access denials.

Security and integrity requirements

• Tenant tables use tenant_id, ENABLE + FORCE RLS, tenant-first indexes, least-privilege roles, and default-deny permissions.
• Document access combines tenant, business scope where applicable, classification/confidentiality, and explicit permission.
• Versions are immutable; corrections create a new version/supersession record.
• Number allocation is atomic and concurrency-safe; committed numbers are unique in their declared scope and cannot be reused silently.
• Template formatting cannot execute arbitrary code, SQL, filesystem/network access, or unbounded regex.
• File references require validated ownership, checksum, safe content metadata, and secure-download authorization.
• High-risk actions—reserve/cancel/void/restore/reclassify—require idempotency where applicable, reason, permission, and audit.

Out of scope

• Domain-specific document schemas/content editors or legal templates.
• Electronic signature/TTE provider integration.
• Full records-management certification or one universal retention schedule.
• General ledger, invoice accounting, procurement, or government correspondence business rules.

Acceptance criteria

• Admission decision/ADR confirms module category and capability dependencies.
• Generic documents, immutable versions, classifications, resource relations, and evidence are tenant-safe and module-neutral.
• Binary content is referenced through an approved file/object capability, not stored as unbounded database blobs.
• Sequence allocation remains unique under concurrent requests and supports reservation/commit/cancel with durable evidence.
• Committed/canceled numbers and immutable versions are never silently reused or rewritten.
• At least five neutral fixtures—correspondence evidence, contract attachment, invoice reference, approval evidence, and asset-disposal evidence—demonstrate reuse without adding their domain rules.
• Classification/confidentiality, business scope, RLS, ABAC, secure-download, checksum, concurrency, idempotency, and audit negative tests pass.
• OpenAPI/AsyncAPI, ERD/data dictionary, architecture/admission docs, threat model, storage/retention integration, admin/user guide, repository inventory, and changeset are updated.
• bun run modules:dag:check, bun run api:spec:check, bun run security:readiness, tests, UI/E2E, build, and bun run check pass.