chore: merge main, resolve biome formatting conflicts

Merge origin/main into feat/external-2fa-codes. Resolve formatting
conflicts caused by biome rollout; preserve both feature streams:
PR's external 2FA token + signing-session 2FA proof additions plus
main's RateLimit/RecipientExpired/signingReminders/date-auto-insert.

In complete-document-with-token.ts, drop the duplicate early
field-fetching block introduced when main moved that logic later
with date auto-insert support; keep the EXTERNAL_TWO_FACTOR_AUTH
check using derivedRecipientActionAuth.

lint-staged.config.cjs

@@ -1,15 +1,5 @@
-const path = require('path');
-
-const eslint = (filenames) =>
-  `eslint --fix ${filenames.map((f) => `"${path.relative(process.cwd(), f)}"`).join(' ')}`;
-
-const prettier = (filenames) =>
-  `prettier --write ${filenames.map((f) => `"${path.relative(process.cwd(), f)}"`).join(' ')}`;
-
 /** @type {import('lint-staged').Config} */
 module.exports = {
-  '**/*.{ts,tsx,cts,mts}': [eslint, prettier],
-  '**/*.{js,jsx,cjs,mjs}': [prettier],
-  '**/*.{yml,mdx}': [prettier],
+  '**/*.{ts,tsx,cts,mts,js,jsx,cjs,mjs,json,css}': 'npm run lint:staged',
   '**/*/package.json': 'npm run precommit',
 };