feat: integration documenso - #1282

Wires role restrictions and the webhook's public route, adds the
documenso.* env vars, and teaches document generation to resolve the
template by name and prefill the topmost guardian block from the linked
monitor using field position, since the guardian and student blocks share
identical labels on the fiche d'engagement.

…apper.java

Co-authored-by: SalomiaZK <salomia.razakarivony@gmail.com>

…apper.java

Co-authored-by: SalomiaZK <salomia.razakarivony@gmail.com>

…e.java

Co-authored-by: SalomiaZK <salomia.razakarivony@gmail.com>

…e.java

Co-authored-by: SalomiaZK <salomia.razakarivony@gmail.com>

…e.java

Co-authored-by: SalomiaZK <salomia.razakarivony@gmail.com>

…e.java

Co-authored-by: SalomiaZK <salomia.razakarivony@gmail.com>

…ovements

- Update all Documenso models with latest structure
- Refactor service layer with improved patterns
- Update API integration code
- Apply all pending changes from development

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

…us enum

PrefillFieldsFactory imported school.hei.haapi.model.TemplateFieldLabels,
which did not exist, breaking compileJava. Add it with the label keywords
matched against Documenso template fields. ADDRESS, PHONE and NIC values
are pinned by PersonSnapshot.field(); FULL_NAME and PARENT_INDICATOR are
derived from the template labels asserted in DocumensoIT. Keywords are
stored accent-free and lowercase since labels are normalized before match.

DocumensoIT needs both DocumensoDocumentStatus enums: the rest.model one
to assert the API response, the model one to build the entity. Keep the
REST import and fully qualify the two entity usages.

Full build passes: 129 test classes, 0 failures, 84.46% line coverage.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>