feat: add cancellable document status (#2992)

Adds a CANCELLED envelope status that privileged members (owner or team
admin/manager) can move a pending document into. Sending recipient
notifications via a background job while retaining the document in the
dashboard as proof of distribution.

Includes a dedicated Cancelled tab, single and bulk cancel actions,
the ENVELOPE_CANCELLED mutability guard, and e2e coverage for
permissions
and visibility.

packages/lib/server-only/envelope/assert-envelope-mutable.ts

@@ -34,8 +34,9 @@ type EnvelopeIdRef = Pick<Envelope, 'id'>;
  * Throws:
  * - `ENVELOPE_TSP_LOCKED` when the envelope is PENDING (the case unique to
  *   the TSP lock — SES routes happily allow PENDING).
- * - `ENVELOPE_COMPLETED` / `ENVELOPE_REJECTED` for those terminal states, to
- *   stay consistent with the existing envelope-state error vocabulary.
+ * - `ENVELOPE_COMPLETED` / `ENVELOPE_REJECTED` / `ENVELOPE_CANCELLED` for those
+ *   terminal states, to stay consistent with the existing envelope-state error
+ *   vocabulary.
  */
 export function assertEnvelopeMutable(envelope: EnvelopeMutableSnapshot): Promise<void>;
 export function assertEnvelopeMutable(envelope: EnvelopeIdRef, tx: Prisma.TransactionClient): Promise<void>;
@@ -73,6 +74,7 @@ const assertSnapshotMutable = (envelope: EnvelopeMutableSnapshot): void => {
     .with(DocumentStatus.PENDING, () => AppErrorCode.ENVELOPE_TSP_LOCKED)
     .with(DocumentStatus.COMPLETED, () => AppErrorCode.ENVELOPE_COMPLETED)
     .with(DocumentStatus.REJECTED, () => AppErrorCode.ENVELOPE_REJECTED)
+    .with(DocumentStatus.CANCELLED, () => AppErrorCode.ENVELOPE_CANCELLED)
     .otherwise(() => AppErrorCode.INVALID_REQUEST);
 
   throw new AppError(errorCode, {