chore: merge main, resolve biome formatting conflicts

Merge origin/main into feat/external-2fa-codes. Resolve formatting
conflicts caused by biome rollout; preserve both feature streams:
PR's external 2FA token + signing-session 2FA proof additions plus
main's RateLimit/RecipientExpired/signingReminders/date-auto-insert.

In complete-document-with-token.ts, drop the duplicate early
field-fetching block introduced when main moved that logic later
with date auto-insert support; keep the EXTERNAL_TWO_FACTOR_AUTH
check using derivedRecipientActionAuth.

packages/lib/server-only/webhooks/execute-webhook-call.ts

@@ -0,0 +1,60 @@
+import type { Prisma } from '@prisma/client';
+
+import { fetchWithTimeout } from '../../utils/timeout';
+import { assertNotPrivateUrl } from './assert-webhook-url';
+
+const WEBHOOK_TIMEOUT_MS = 10_000;
+
+export type WebhookCallResult = {
+  success: boolean;
+  responseCode: number;
+  responseBody: Prisma.InputJsonValue | Prisma.JsonNullValueInput;
+  responseHeaders: Record<string, string>;
+};
+
+const parseBody = (text: string): Prisma.InputJsonValue => {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+};
+
+export const executeWebhookCall = async (options: {
+  url: string;
+  body: unknown;
+  secret: string | null;
+}): Promise<WebhookCallResult> => {
+  const { url, body, secret } = options;
+
+  try {
+    await assertNotPrivateUrl(url);
+
+    const response = await fetchWithTimeout(url, {
+      method: 'POST',
+      body: JSON.stringify(body),
+      redirect: 'manual',
+      timeoutMs: WEBHOOK_TIMEOUT_MS,
+      headers: {
+        'Content-Type': 'application/json',
+        'X-Documenso-Secret': secret ?? '',
+      },
+    });
+
+    const text = await response.text();
+
+    return {
+      success: response.ok,
+      responseCode: response.status,
+      responseBody: parseBody(text),
+      responseHeaders: Object.fromEntries(response.headers.entries()),
+    };
+  } catch (err) {
+    return {
+      success: false,
+      responseCode: 0,
+      responseBody: err instanceof Error ? err.message : 'Unknown error',
+      responseHeaders: {},
+    };
+  }
+};