Client-stepper: pre-fill existing KYC/address proofs in edit, fix identifier saves

Edit-mode now shows the previously selected KYC document type + uploaded file thumbnail
(loads from /clients/{id}/identifiers + /client_identifiers/{id}/documents). Same for
address proof on the India address step. Closes the gap where editing a client showed
an empty file picker even when proof had been uploaded on create.

Identifier-save hardened across all three callsites (create-client, edit-client,
identities-tab.createIdentifierWithDocs) - the KYC chip picker proofId is a CODE
string ('AADHAAR'), but backend ClientIdentifierRequest.documentTypeId is Long, which
Spring rejects with HttpMessageNotReadableException -> 400. resolveDocumentTypeId
helper looks up the code against /kyc/proof-types?type=id and substitutes the numeric
CodeValue id before posting. Skips silently for constitution-specific non-individual
docs that have no CodeValue mapping.

KYC payload normalises panNumber / enterprisePan / gstinNumber / cinNumber via
toUpperCase + whitespace strip so user-typed lowercase or trailing spaces don't trip
the backend regex (validation.msg.CLIENTKYC.panNumber.does.not.match.regexp).

State name match in client-address save now normalises both sides (lowercase, collapse
underscores + spaces) so legacy MADHYA_PRADESH resolves to 'Madhya Pradesh' returned
by api.postalpincode.in. Backed by tenant migration 0297.

Identities-tab resolver flattened - was returning identifiers before the per-row
forkJoin(getClientIdentificationDocuments) completed, so the view rendered empty
documents arrays. Now uses switchMap + forkJoin so the resolver awaits completion.

Also bundles concurrent work-in-progress on letter-mgmt, organization, users,
bank-calendar, shell, nominee/notes/identifier dialogs, and theming.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/app/letter-mgmt/certificates/share-certificate/share-certificate.component.ts

@@ -20,6 +20,7 @@ import {
   CertificatePreviewDialogData
 } from '../certificate-preview-dialog/certificate-preview-dialog.component';
 import { downloadShareCertificatePdf } from '../certificate-pdf';
+import { DscSignService } from '../../dsc-sign-dialog/dsc-sign.service';
 
 export type ShareClass = 'ORDINARY' | 'PREFERENCE';
 
@@ -58,6 +59,7 @@ export interface ShareCertificateRecord {
 export class ShareCertificateComponent implements OnInit {
   private dialog = inject(MatDialog);
   private snack = inject(MatSnackBar);
+  private dscSign = inject(DscSignService);
 
   // ── Filters ──
   search = '';
@@ -132,8 +134,14 @@ export class ShareCertificateComponent implements OnInit {
   }
 
   downloadCertificate(r: ShareCertificateRecord): void {
-    downloadShareCertificatePdf(r);
-    this.snack.open(`Share Certificate ${r.certificateNo} downloaded.`, 'OK', { duration: 2400 });
+    this.dscSign.promptThenDownload(
+      {
+        title: 'Share Certificate',
+        reference: `${r.certificateNo} · Folio ${r.folioNo} · ${r.memberName}`,
+        filename: `Share-Certificate-${r.certificateNo}.pdf`
+      },
+      (dsc) => downloadShareCertificatePdf(r, dsc)
+    );
   }
 }