manual verification: review follow-ups and persona capture fix

[leowilkin]

follow-ups from the code review of #306, plus the production fix for the persona capture flow.

production fix

every "scan with your camera" start was 400ing. the capture template's prefill field keys are underscored (name_first, name_last, email_address) where the kyc templates use hyphens, and persona rejects prefill for unknown keys. keys corrected, and persona api errors now include the detail field so the next one says why in sentry.

review findings

1. denial double-notified the user. denying a case fired the shared rejected_* mailers, which carry the internal rejection reason + details and a resubmit link, on top of the reason-free case email. the user-facing mailers are suppressed for manual calls; the staff-only slack deactivation ping on a fatal reason stays.
2. persona capture skipped consent. the camera path submitted docs without recording attestation, biometric consent or the submitted fields the direct-upload path requires. both paths now start from one form that persists them, and submit_docs! has a guard so no caller can advance without them. a webhook arriving without consent on record drops the capture. direct upload is now strict server-side about the four required fields too.
3. deletion left case pii. submitted_fields, the persona signal snapshot, inquiry ids, access tokens, event ip/ua, free-text event data, comment bodies, qa sample notes and checklist notes all survived a privacy deletion. scrubbed in place; rows and event keys stay so the audit shape survives.
4. link reminder locked out active users. the reminder scope rotated tokens for users who had already opened their link. consumed tokens are excluded and rechecked under lock.
5. resend persisted the token before checking the transition. now with_lock, check first, and a plain resend keeps access_token_used_at. only request-redo re-arms the gate.
6. break-glass audit event written before authz/save. moved into the save transaction with the persisted reason.
7. cal.com webhooks weren't idempotent. state checked before any write, everything under lock, duplicate deliveries are quiet, reschedules mail once per actual change, stale-uid cancellations ignored. ignored deliveries leave a call_booking_ignored event.
8. case destroy always raised. events/comments/documents leave the destroy cascade so the paranoid soft-delete works; hard delete of a case raises on purpose.
9. tampered upload params 500'd. non-file and zero-byte values get a flash.
10. persona photos hardcoded as jpeg. sniffed with marcel; unsupported types rejected with an audit event; a capture with zero usable files no longer advances.

behaviour changes worth a glance

• direct upload now rejects a submission missing legal name, dob, document type or issuing authority (previously html required only).
• a persona capture whose downloads all fail used to advance to docs submitted with zero documents. it now refuses and resets the inquiry.
• staff will see two new event keys in case timelines: call_booking_ignored and capture_files_rejected.

testing

all touched spec files: 212 examples, 0 failures. rubocop clean on changed files.