feat(documents): implement clinical document lifecycle invariants (CYN-40)

[SiddharthaGF]

Summary

• Add the clinical document lifecycle state machine: inProgress → completed / canceled / enteredInError, and completed → enteredInError; invalid transitions fail atomically without touching the bound response
• POST /api/clinicalDocuments/{id}/complete|cancel|enter-in-error with optimistic concurrency (rowVersion), capability gates, and audit (document.completed / document.canceled / document.enteredInError)
• Completion validates answers in complete mode and completes the bound form response in the same transaction, so completed content is immutable — no overwrite or physical delete path exists
• Entered-in-error records persist and expose reason, actor, and timestamp and stay queryable for authorized users

Test plan

• dotnet cake --target=Check (format + lint + tests) — 356 tests, 0 warnings
• Complete an in-progress document → 200, bound response completed and locked (further PATCH → 409), document.completed audit
• Cancel → 200, canceled, bound response stays draft; stale rowVersion → 409; complete/cancel on a completed document → 409
• Enter-in-error from completed → 200 with reason/actor/timestamp, still visible in GET + list filters; missing reason → 400; cross-tenant transitions → 404
• New unit coverage: ClinicalDocumentLifecycle state machine + service transition branches (concurrency, actor policy, atomicity) — 39 document unit tests

Linear:

• https://linear.app/ailuracode/issue/CYN-40/implement-clinical-document-lifecycle-invariants

Sonar cleanup (same branch)

• refactor(application): introduce IWorkflowContext (tenant + clock) to bring 4 services with S107 (8 ctor params) back to 7 — ClinicalDocumentService, EncounterService, DocumentCatalogService, FormReviewService
• refactor(api): resolve remaining smells — CapabilityForbiddenException standard constructors (S3871), expression-bodied lambda, doc comment, conditional access
• test(capabilities): add missing assertion to RequireAsync_Passes_WhenCapabilityGranted (S2699)
• chore(sonar): exclude generated EF Migrations/ from analysis (S104 on InitialCreate + CPD noise on generated DDL)
• Verified: SonarScan quality gate OK, new_violations: 0, new_duplicated_lines_density: 1.79%, 0 unresolved issues

[github-actions]

Neon branch ready.