Add document approval workflow

Introduce a complete approval system for document publishing. Document
versions can now require approval from selected reviewers before being
published, with automatic publishing once all approvers have approved.

- Add approval quorum and decision tables with backfill migration
- Implement request approval, approve, and reject flows with electronic
  signature support for approve decisions
- Add employee approvals page with dedicated tab and pending approvals view
- Add changelog field to publish and request approval flows
- Pre-select previous version's approvers in the publish dialog
- Show quorum approvers in document list with 100 approver hard limit
- Expose approval workflow through GraphQL, MCP, and CLI
- Remove legacy default approvers feature entirely
- Add comprehensive e2e test coverage for approval workflows

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

pkg/coredata/document_version.go

@@ -50,18 +50,44 @@ type (
 // AuthorizationAttributes returns the authorization attributes for policy evaluation.
 func (dv *DocumentVersion) AuthorizationAttributes(ctx context.Context, conn pg.Conn) (map[string]string, error) {
 	q := `
+WITH document_version AS (
+	SELECT id, document_id, organization_id, status AS version_status
+	FROM document_versions
+	WHERE id = $1
+	LIMIT 1
+),
+document AS (
+	SELECT d.id, d.status
+	FROM documents d
+	INNER JOIN document_version ON d.id = document_version.document_id
+),
+last_quorum AS (
+	SELECT
+		q.version_id,
+		q.status::text AS status
+	FROM document_version_approval_quorums q
+	INNER JOIN document_version ON q.version_id = document_version.id
+	ORDER BY q.created_at DESC
+	LIMIT 1
+)
 SELECT
-	dv.organization_id,
-	d.status
-FROM document_versions dv
-INNER JOIN documents d ON d.id = dv.document_id
-WHERE dv.id = $1
-LIMIT 1;
+	document_version.organization_id,
+	document.status,
+	document_version.version_status,
+	COALESCE(lq.status, '')
+FROM document_version
+INNER JOIN document ON document.id = document_version.document_id
+LEFT JOIN last_quorum lq ON lq.version_id = document_version.id;
 `
 
-	var organizationID gid.GID
-	var documentStatus DocumentStatus
-	if err := conn.QueryRow(ctx, q, dv.ID).Scan(&organizationID, &documentStatus); err != nil {
+	var (
+		organizationID        gid.GID
+		documentStatus        DocumentStatus
+		documentVersionStatus DocumentVersionStatus
+		lastQuorumStatus      string
+	)
+
+	if err := conn.QueryRow(ctx, q, dv.ID).Scan(&organizationID, &documentStatus, &documentVersionStatus, &lastQuorumStatus); err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
 			return nil, ErrResourceNotFound
 		}
@@ -69,8 +95,10 @@ LIMIT 1;
 	}
 
 	return map[string]string{
-		"organization_id": organizationID.String(),
-		"document_status": documentStatus.String(),
+		"organization_id":    organizationID.String(),
+		"document_status":    documentStatus.String(),
+		"version_status":     documentVersionStatus.String(),
+		"last_quorum_status": lastQuorumStatus,
 	}, nil
 }