Backend support for signature rejection #8159

Implement the backend support required by #7832.

This issue should provide the backend foundation for the signature rejection workflow. Frontend configuration, signing UI, and validation page will be handled in separate issues.

Scope

Implement the backend support to:

• allow a signer to reject a signature request;
• store the rejection state and timestamp;
• store the rejection comment when provided;
• support the rejection rules defined in the policy system;
• define the effective behavior when a signer rejects, including whether the remaining signing workflow can continue;
• expose the required information through the API for the signing flow, policy configuration UI, and validation page;
• prevent actions that are no longer valid after the workflow is closed;
• register the rejection in the audit trail;
• dispatch the appropriate LibreSign events and Activities.

The implementation must use the existing Policies & Rules architecture. Policy resolution, scopes, inheritance, delegation, and overrides should follow the same patterns already used by other LibreSign policies.

Avoid introducing temporary global app configuration that would later need to be migrated to Policies & Rules.

Tests

Add or update tests covering at least:

• policy resolution and default behavior;
• rejection of a signature request;
• optional and required rejection comments;
• workflow continuation and cancellation behavior;
• multiple signers;
• API validation and permissions;
• persistence and retrieval of rejection information;
• actions that must be blocked after workflow cancellation;
• audit trail and relevant events.

Use unit tests for isolated business logic and Behat/integration tests for the relevant end-to-end backend flows.

Use data providers where they reduce duplicated scenarios.

Mutation testing

New or changed backend business logic related to this feature must be covered by Infection.

For reasonably isolated new classes:

• no escaped mutants;
• no mutation errors;
• target 100% MSI.

Do not weaken Infection configuration or exclude production code only to make the tests pass.

Quality gates

The implementation must pass the existing backend checks, including:

• PHPUnit;
• Behat/integration tests;
• Psalm;
• PHPCS;
• Infection.

Out of scope

This issue does not implement:

• the Policy Workbench UI;
• the signing/rejection frontend flow;
• the validation page UI.

These will be handled in follow-up issues linked to #7832.