Version financial disclosures and bind accepted consent to financial …

[mimijuwonlo-commits]

Summary

• Add immutable legal document versions with canonical bytes, locale, jurisdiction, effective dates, material-change metadata, and SHA-256 verification.
• Add transaction-bound consent challenges and affirmative consent acceptances with render manifests, hashed session/wallet evidence, withdrawal/export support, and replay protection.
• Require accepted consent for pool investments and persist the exact accepted document set on each investment record.
• Add stable consent API errors and consent workflow contracts/routes.

What Changed

• New models:
  • LegalDocumentVersion
  • ConsentChallenge
  • ConsentAcceptance
• New consent service:
  • challenge creation
  • challenge acceptance
  • document set hashing
  • acceptance verification
  • material-change re-consent checks
  • grandfathering support
  • consent evidence export
• New API routes:
  • POST /api/consent/challenges
  • POST /api/consent/challenges/{challengeId}/accept
  • GET /api/consent/acceptances/{acceptanceId}/export
• Updated pool investment flow to require and persist:
  • consentAcceptanceId
  • acceptedDocumentSetHash
  • acceptedDocumentVersionIds
• Added stable errors:
  • CONSENT_REQUIRED
  • CONSENT_INVALID

Tests

• Added coverage for:
  • concurrent document publication
  • locale fallback
  • expired consent challenge
  • replayed consent challenge
  • replay across changed transaction terms
  • changed fee schedule re-consent
  • grandfathered contracts
  • exportable consent evidence
  • accessibility render manifest
  • legal document hash verification

Verification

• npm test -- --run __tests__/lib/api/contracts.test.ts __tests__/lib/consent/financial-consent.test.ts
• npm run typecheck
• npm run lint

Lint passes with two existing unrelated warnings.

Closes #145