Fix/id docs ldap join and approval status

[lfals]

Resolves: #7861
Resolves: #7860

📝 Summary

Identification documents from LDAP/SSO accounts disappeared from the account page because IdDocsMapper used an inner join on oc_users. Those backends do not create a row there, so list() dropped the files even when filtering by userId.

Approving an identification document also never reached SIGNED. The uploader gets a DRAFT SignRequest so the account page can show a display name; evaluateStatusFromSigners() counted that placeholder as a required signature, so the file stayed PARTIAL_SIGNED after the approver signed.

This change left-joins users when listing identification documents, and excludes only that uploader placeholder from status evaluation. Sequential-signing DRAFT signers on normal files are unchanged.

🧪 How to test

1. Enable Identification documents flow in LibreSign admin settings and set admin as an approver.
2. Open the LibreSign account page (/apps/libresign/f/account) and confirm the Identification documents section is visible.
3. Upload a test PDF with Upload file (tests/php/fixtures/pdfs/small_valid.pdf).
4. Confirm the card no longer shows Not sent yet and that Delete file is available. Reload the page: the document must still be listed.
5. Open Document Validation (/apps/libresign/f/docs/id-docs/validation). The row should show waiting for approval and a Sign action.
6. Create a certificate for admin if needed, then click Sign and complete the signature.
7. After signing, the list status must become approved (not stuck as partially signed). The Sign action is replaced by Validate.
8. LDAP-specific check for ID documents of LDAP users are invisible on the account page (INNER JOIN on oc_users) #7861: repeat steps 2–4 as an LDAP user who has no row in oc_users. The uploaded document must remain visible on that account.

composer test:unit -- --filter IdDocsMapperTest
composer test:unit -- --filter testIdDocApprovalReachesSignedWhenUploaderPlaceholderIsUnsigned
composer test:unit -- --filter testDraftSignersStillCountWhenFileIsNotAnIdentificationDocument
npx playwright test playwright/e2e/id-docs-visual.spec.ts

⚙️ API / Back‑end changes

• IdDocsMapper::getQueryBuilder() always leftJoins users, so listing by userId still returns documents when the account is missing from oc_users.
• SignFileService::evaluateStatusFromSigners() ignores the identification-document uploader placeholder (id_docs.sign_request_id) so approval can reach SIGNED.
• Unit and/or integration tests added – required for backend changes

✅ Checklist

• I have read and followed the contribution guide.
• Focused PHPUnit coverage added for the LDAP list join and ID-doc approval status.
• Playwright coverage added for upload, account listing, and the approval queue.

🤖 AI (if applicable)

• The content of this PR was partially or fully generated using AI

[welcome]

Thanks for opening your first pull request in this repository! ✌️

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.
see 180 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[vitormattos]

Could we catch only DoesNotExistException here instead of \Throwable?

A missing IdDocs entry is expected for regular files, but an unexpected database/programming error should probably not be silently treated as “not an identification document”.

[vitormattos]

/backport to stable34

[vitormattos]

/backport to stable33

[vitormattos]

/backport to stable32