feat(documents): delete stored file from storage on document deletion

feat(crypto): expose CryptoSigner interface and WithCryptoSigner builder option

chore: ignore .auto-claude/ directory

fix(auth): set tenant_id on magic link tokens to satisfy RLS policy

feat(admin): reload config before returning settings in GET handler

fix(auth): fallback to direct cleanup when tenant context is unavailable

fix(csp): remove unnecessary style-src unsafe-inline from proxy and storage handlers

feat(email): simplify reminder email now that document viewer is on the reading page

fix(checksum): fall back to DefaultOptions for zero-value ChecksumConfig fields

fix(e2e): correct test 17 to match actual API contracts

fix(signing): deduce ReadMode from context when not explicitly set

test(signing): add unit and e2e tests for inaccessible URL fallback

fix(signing): resolve deadlock when document URL is inaccessible

chore(ci): bump GitHub Actions to v6 (checkout, setup-node, setup-go, artifacts)

fix(email): disable opportunistic STARTTLS when TLS and StartTLS are both off