feat(documents): add inbound clinical-document data model (migration 0218)

Store an uploaded doctor report / discharge letter and stage extracted
structured facts for review. Two models:

- InboundDocument: the uploaded document, raw bytes encrypted at rest via
  the shared AES-256-GCM Bytes codec (content_encrypted), with queryable
  metadata (kind, mime, size, status, report date).
- ExtractedFact: the review-then-confirm staging row — fact type, status,
  per-field provenance, a confidence score, and a needs-review gate, plus
  the FHIR-staged payload (stated codes/status only) as JSONB.

Wire content_encrypted into the encryption-key rotation registry and the
rotation script so a key drop never strands a stored document.

scripts/rotate-encryption-key.ts

@@ -475,6 +475,18 @@ async function main() {
     ),
   );
 
+  // ───── v1.25 (W-DOCS-IN) inbound clinical document (Bytes column) ─────
+  // The raw uploaded doctor report / discharge letter (base64-of-binary →
+  // AES-256-GCM string → UTF-8 bytes). Always encrypted on write (NOT NULL),
+  // so every row rotates.
+  results.push(
+    await rotateBytesColumn(
+      "InboundDocument",
+      "contentEncrypted",
+      prisma.inboundDocument,
+    ),
+  );
+
   console.log("\n=== Rotation summary ===");
   let totalRotated = 0;
   let totalErrors = 0;