feat(documents): bidirectional labs ↔ documents cross-link

Two directions, folding the vault and labs pipelines into one linking path
without weakening either manual flow.

Vault document → lab values (auto-stage). After the per-document auto-index
job transcribes a stored document, a lab-looking document is run through the
same inbound extraction the manual "Extract" button uses, but the facts land
PENDING for the existing human review — nothing is committed. Gated on both
the documents and labs modules plus the auto-AI-read consent gate the
auto-index external path already uses; a text-structuring pass over the
transcription the index just produced, so no second vision call is spent. The
staging is a guarded STORED→EXTRACTED transition, and a keyword heuristic (or
an explicit LAB_RESULT kind) keeps an arbitrary photo from burning a call.
Everyone without the opt-in keeps the manual extract button.

Lab scan → vault. A lab report scanned in the labs area is now also filed
into the Documents vault (kind LAB_RESULT) through the existing upload —
encrypted at rest, EXIF-stripped, thumbnailed, sha256-deduped — and the
committed labs are cross-linked back to it with the same APPROVED-observation
provenance the manual vault → labs path produces. Text-mode scans keep the
image on-device and file nothing. Idempotent: a re-commit inserts no rows and
links nothing new, and the vault dedupe means no duplicate document.

Owner-scoped and module-gated on both sides; the cross-link is best-effort so
it never fails the authoritative write.

src/lib/validations/labs-ocr.ts

@@ -179,6 +179,14 @@ export type OcrCommitRow = z.infer<typeof ocrCommitRowSchema>;
 
 export const ocrCommitSchema = z.object({
   rows: z.array(ocrCommitRowSchema).min(1).max(OCR_MAX_ROWS),
+  /**
+   * S9 — the vault document the client filed the scanned bytes into (kind
+   * LAB_RESULT), so the committed labs can be cross-linked back to their source
+   * (`inboundDocuments` module on). Optional: text-mode scans keep the image
+   * on-device and file nothing, and a module-off account never files. Ownership
+   * is verified server-side before any link is written.
+   */
+  documentId: z.string().trim().min(1).max(64).optional(),
 });
 
 export type OcrCommitInput = z.infer<typeof ocrCommitSchema>;