chore: merge main, resolve biome formatting conflicts

Merge origin/main into feat/external-2fa-codes. Resolve formatting
conflicts caused by biome rollout; preserve both feature streams:
PR's external 2FA token + signing-session 2FA proof additions plus
main's RateLimit/RecipientExpired/signingReminders/date-auto-insert.

In complete-document-with-token.ts, drop the duplicate early
field-fetching block introduced when main moved that logic later
with date auto-insert support; keep the EXTERNAL_TWO_FACTOR_AUTH
check using derivedRecipientActionAuth.

packages/lib/utils/envelope.ts

@@ -1,11 +1,5 @@
 import type { Envelope, Recipient } from '@prisma/client';
-import {
-  DocumentStatus,
-  EnvelopeType,
-  RecipientRole,
-  SendStatus,
-  SigningStatus,
-} from '@prisma/client';
+import { DocumentStatus, EnvelopeType, RecipientRole, SendStatus, SigningStatus } from '@prisma/client';
 import { match } from 'ts-pattern';
 import { z } from 'zod';
 
@@ -53,10 +47,7 @@ export type EnvelopeIdsOptions =
  *
  * This is UNSAFE because does not validate access, it just builds the query for ID and TYPE.
  */
-export const unsafeBuildEnvelopeIdQuery = (
-  options: EnvelopeIdOptions,
-  expectedEnvelopeType: EnvelopeType | null,
-) => {
+export const unsafeBuildEnvelopeIdQuery = (options: EnvelopeIdOptions, expectedEnvelopeType: EnvelopeType | null) => {
   return match(options)
     .with({ type: 'envelopeId' }, (value) => {
       const parsed = ZEnvelopeIdSchema.safeParse(value.id);
@@ -112,10 +103,7 @@ export const unsafeBuildEnvelopeIdQuery = (
  *
  * @throws AppError if any ID is invalid or if the array exceeds the maximum limit
  */
-export const unsafeBuildEnvelopeIdsQuery = (
-  options: EnvelopeIdsOptions,
-  expectedEnvelopeType: EnvelopeType | null,
-) => {
+export const unsafeBuildEnvelopeIdsQuery = (options: EnvelopeIdsOptions, expectedEnvelopeType: EnvelopeType | null) => {
   if (!options.ids || options.ids.length === 0) {
     throw new AppError(AppErrorCode.INVALID_BODY, {
       message: 'At least one ID is required',
@@ -244,28 +232,57 @@ export const mapSecondaryIdToTemplateId = (secondaryId: string) => {
   return parseInt(parsed.data.split('_')[1]);
 };
 
-export const canEnvelopeItemsBeModified = (
-  envelope: Pick<Envelope, 'completedAt' | 'deletedAt' | 'type' | 'status'>,
-  recipients: Recipient[],
-) => {
-  if (envelope.completedAt || envelope.deletedAt || envelope.status !== DocumentStatus.DRAFT) {
-    return false;
-  }
-
-  if (envelope.type === EnvelopeType.TEMPLATE) {
-    return true;
-  }
-
-  if (
-    recipients.some(
-      (recipient) =>
-        recipient.role !== RecipientRole.CC &&
-        (recipient.signingStatus === SigningStatus.SIGNED ||
-          recipient.sendStatus === SendStatus.SENT),
-    )
-  ) {
-    return false;
-  }
-
-  return true;
+export type EnvelopeItemPermissions = {
+  canTitleBeChanged: boolean;
+  canFileBeChanged: boolean;
+  canOrderBeChanged: boolean;
+};
+
+export const getEnvelopeItemPermissions = (
+  envelope: Pick<Envelope, 'completedAt' | 'deletedAt' | 'type' | 'status'>,
+  recipients: Pick<Recipient, 'role' | 'signingStatus' | 'sendStatus'>[],
+): EnvelopeItemPermissions => {
+  // Always reject completed/rejected/deleted envelopes.
+  if (
+    envelope.completedAt ||
+    envelope.deletedAt ||
+    envelope.status === DocumentStatus.REJECTED ||
+    envelope.status === DocumentStatus.COMPLETED
+  ) {
+    return {
+      canTitleBeChanged: false,
+      canFileBeChanged: false,
+      canOrderBeChanged: false,
+    };
+  }
+
+  // Templates can always be modified.
+  if (envelope.type === EnvelopeType.TEMPLATE) {
+    return {
+      canTitleBeChanged: true,
+      canFileBeChanged: true,
+      canOrderBeChanged: true,
+    };
+  }
+
+  const hasActiveRecipients = recipients.some(
+    (recipient) =>
+      recipient.role !== RecipientRole.CC &&
+      (recipient.signingStatus === SigningStatus.SIGNED ||
+        recipient.signingStatus === SigningStatus.REJECTED ||
+        recipient.sendStatus === SendStatus.SENT),
+  );
+
+  return match(envelope.status)
+    .with(DocumentStatus.DRAFT, () => ({
+      canTitleBeChanged: true,
+      canFileBeChanged: true,
+      canOrderBeChanged: true,
+    }))
+    .with(DocumentStatus.PENDING, () => ({
+      canTitleBeChanged: true,
+      canFileBeChanged: false,
+      canOrderBeChanged: !hasActiveRecipients, // Only allow order changes if no active recipients.
+    }))
+    .exhaustive();
 };