E-sign: KBA + IRS 8879 path

First named post-launch e-sign milestone (market audit #3): knowledge-based authentication on Documenso so firms can collect IRS 8879 e-file authorizations compliantly. Launch e-sign is engagement letters only (no KBA) — this unlocks the tax-season workflow that actually differentiates a CPA portal. Also in this lane: real SMTP for signer mail and the document-signing certificate (pre-external-signers ops items).