Phase 2: migrate documents.ts onto pg

1046-line file converted from the Supabase JS client to parameterised
pg queries. 16 db.from calls migrated.

Key changes:
- handleDocumentUpload duplicate removed. Both routes (single-docs
  POST and projects POST) now import the shared implementation from
  projects.ts. This also drops ~140 lines of duplicate
  countPdfPages/extractStructureTree code.
- Edit-resolution flow (accept / reject tracked changes):
  - The pending-edits count uses `SELECT count(*)::text` instead of
    the Supabase PostgREST head-count pattern.
  - status / resolved_at updates use parameterised UPDATE.
  - All idempotent-already-resolved and not-found-in-docx branches
    still emit the same response shapes for backward compatibility.
- DELETE /single-documents/:id keeps the storage-fanout cleanup
  (download every version row's storage_path + pdf_storage_path,
  delete the underlying object) before removing the documents row.
- POST /:id/versions:
  - Computes the next version_number with `ORDER BY version_number
    DESC NULLS LAST LIMIT 1`.
  - Conditionally rewrites documents.filename to honour a
    user-supplied display_name, preserving the original or uploaded
    extension.

End-to-end verification against Postgres 16:
  - GET /single-documents lists own docs with storage_path attached.
  - GET /single-documents/:id/versions returns current_version_id
    plus the versions list.
  - PATCH version display_name applies.
  - DELETE returns 204 and removes the row + cascades.
  - download-zip rejects an empty array with 400.
  - Existing /projects and /workflows routes still pass regression.

Remaining on Supabase JS: chat.ts (12), projectChat.ts (4),
tabular.ts (19), chatTools.ts (12).