chore: merge main, resolve biome formatting conflicts

Merge origin/main into feat/external-2fa-codes. Resolve formatting
conflicts caused by biome rollout; preserve both feature streams:
PR's external 2FA token + signing-session 2FA proof additions plus
main's RateLimit/RecipientExpired/signingReminders/date-auto-insert.

In complete-document-with-token.ts, drop the duplicate early
field-fetching block introduced when main moved that logic later
with date auto-insert support; keep the EXTERNAL_TWO_FACTOR_AUTH
check using derivedRecipientActionAuth.

packages/prisma/migrations/20251101000330_add_new_webhook_events/migration.sql

@@ -0,0 +1,14 @@
+-- AlterEnum
+-- This migration adds more than one value to an enum.
+-- With PostgreSQL versions 11 and earlier, this is not possible
+-- in a single migration. This can be worked around by creating
+-- multiple migrations, each migration adding only one value to
+-- the enum.
+
+
+ALTER TYPE "WebhookTriggerEvents" ADD VALUE 'DOCUMENT_RECIPIENT_COMPLETED';
+ALTER TYPE "WebhookTriggerEvents" ADD VALUE 'DOCUMENT_REMINDER_SENT';
+ALTER TYPE "WebhookTriggerEvents" ADD VALUE 'TEMPLATE_CREATED';
+ALTER TYPE "WebhookTriggerEvents" ADD VALUE 'TEMPLATE_UPDATED';
+ALTER TYPE "WebhookTriggerEvents" ADD VALUE 'TEMPLATE_DELETED';
+ALTER TYPE "WebhookTriggerEvents" ADD VALUE 'TEMPLATE_USED';

packages/prisma/migrations/20260219091107_add_recipient_expirations/migration.sql

@@ -0,0 +1,18 @@
+-- AlterEnum
+ALTER TYPE "WebhookTriggerEvents" ADD VALUE 'RECIPIENT_EXPIRED';
+
+-- AlterTable
+ALTER TABLE "DocumentMeta" ADD COLUMN     "envelopeExpirationPeriod" JSONB;
+
+-- AlterTable
+ALTER TABLE "OrganisationGlobalSettings" ADD COLUMN     "envelopeExpirationPeriod" JSONB;
+
+-- AlterTable
+ALTER TABLE "Recipient" ADD COLUMN     "expirationNotifiedAt" TIMESTAMP(3),
+ADD COLUMN     "expiresAt" TIMESTAMP(3);
+
+-- AlterTable
+ALTER TABLE "TeamGlobalSettings" ADD COLUMN     "envelopeExpirationPeriod" JSONB;
+
+-- CreateIndex
+CREATE INDEX "Recipient_expiresAt_idx" ON "Recipient"("expiresAt");

packages/prisma/migrations/20260219141233_add_rate_limit_table/migration.sql

@@ -0,0 +1,13 @@
+-- CreateTable
+CREATE TABLE "RateLimit" (
+    "key" TEXT NOT NULL,
+    "action" TEXT NOT NULL,
+    "bucket" TIMESTAMP(3) NOT NULL,
+    "count" INTEGER NOT NULL DEFAULT 1,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "RateLimit_pkey" PRIMARY KEY ("key","action","bucket")
+);
+
+-- CreateIndex
+CREATE INDEX "RateLimit_createdAt_idx" ON "RateLimit"("createdAt");

packages/prisma/migrations/20260224000000_add_email_domain_last_verified_at/migration.sql

@@ -0,0 +1,2 @@
+-- AlterTable
+ALTER TABLE "EmailDomain" ADD COLUMN "lastVerifiedAt" TIMESTAMP(3);

packages/prisma/migrations/20260302223702_optimize_recipient_indexes/migration.sql

@@ -0,0 +1,17 @@
+-- CreateExtension
+CREATE EXTENSION IF NOT EXISTS pg_trgm;
+
+-- CreateIndex
+CREATE INDEX IF NOT EXISTS "Recipient_email_documentDeletedAt_envelopeId_idx" ON "Recipient"("email", "documentDeletedAt", "envelopeId");
+
+-- CreateIndex
+CREATE INDEX IF NOT EXISTS "Recipient_email_envelopeId_idx" ON "Recipient"("email", "envelopeId");
+
+-- CreateIndex
+CREATE INDEX IF NOT EXISTS "Recipient_email_signingStatus_envelopeId_role_idx" ON "Recipient"("email", "signingStatus", "envelopeId", "role");
+
+-- CreateIndex
+CREATE INDEX IF NOT EXISTS "Recipient_email_trgm_idx" ON "Recipient" USING GIN ("email" gin_trgm_ops);
+
+-- CreateIndex
+CREATE INDEX IF NOT EXISTS "Recipient_name_trgm_idx" ON "Recipient" USING GIN ("name" gin_trgm_ops);

packages/prisma/migrations/20260311000000_add_organisation_template_type/migration.sql

@@ -0,0 +1 @@
+ALTER TYPE "TemplateType" ADD VALUE 'ORGANISATION';

packages/prisma/migrations/20260401000000_add_reminder_settings/migration.sql

@@ -0,0 +1,16 @@
+-- AlterTable
+ALTER TABLE "DocumentMeta" ADD COLUMN     "reminderSettings" JSONB;
+
+-- AlterTable
+ALTER TABLE "OrganisationGlobalSettings" ADD COLUMN     "reminderSettings" JSONB;
+
+-- AlterTable
+ALTER TABLE "TeamGlobalSettings" ADD COLUMN     "reminderSettings" JSONB;
+
+-- AlterTable
+ALTER TABLE "Recipient" ADD COLUMN     "sentAt" TIMESTAMP(3),
+ADD COLUMN     "lastReminderSentAt" TIMESTAMP(3),
+ADD COLUMN     "nextReminderAt" TIMESTAMP(3);
+
+-- CreateIndex
+CREATE INDEX "Recipient_nextReminderAt_idx" ON "Recipient"("nextReminderAt");

packages/prisma/migrations/20260408052212_add_set_null_for_audit_log_foreign_key/migration.sql

@@ -0,0 +1,8 @@
+-- DropForeignKey
+ALTER TABLE "DocumentAuditLog" DROP CONSTRAINT "DocumentAuditLog_envelopeId_fkey";
+
+-- AlterTable
+ALTER TABLE "DocumentAuditLog" ALTER COLUMN "envelopeId" DROP NOT NULL;
+
+-- AddForeignKey
+ALTER TABLE "DocumentAuditLog" ADD CONSTRAINT "DocumentAuditLog_envelopeId_fkey" FOREIGN KEY ("envelopeId") REFERENCES "Envelope"("id") ON DELETE SET NULL ON UPDATE CASCADE;

packages/prisma/migrations/20260504000000_add_allow_personal_organisations_to_auth_portal/migration.sql

@@ -0,0 +1,10 @@
+-- AlterTable
+-- Add the column with a temporary default of `true` so that all existing rows
+-- (representing organisations created before this feature) are backfilled to
+-- `true` — preserving the historical behaviour of creating personal
+-- organisations for SSO-provisioned users.
+ALTER TABLE "OrganisationAuthenticationPortal" ADD COLUMN "allowPersonalOrganisations" BOOLEAN NOT NULL DEFAULT true;
+
+-- Switch the column default to `false` so that any organisations created from
+-- now on opt out of personal-organisation creation by default.
+ALTER TABLE "OrganisationAuthenticationPortal" ALTER COLUMN "allowPersonalOrganisations" SET DEFAULT false;

packages/prisma/migrations/20260507043737_add_custom_css_branding/migration.sql

@@ -0,0 +1,7 @@
+-- AlterTable
+ALTER TABLE "OrganisationGlobalSettings" ADD COLUMN     "brandingColors" JSONB,
+ADD COLUMN     "brandingCss" TEXT NOT NULL DEFAULT '';
+
+-- AlterTable
+ALTER TABLE "TeamGlobalSettings" ADD COLUMN     "brandingColors" JSONB,
+ADD COLUMN     "brandingCss" TEXT;