fix(p2-02): the document view route loses its request scope under pnpm dev #127

Under pnpm dev, GET /api/documents/[documentId]/view fails: Next.js logs that cookies was called outside a request scope. The stack goes through createSessionClient (src/server/supabase/server.ts:10), signAndLog (src/server/documents/actions.ts) and openDocument.

The route handler imports openDocument from @/server/documents/actions.ts. That file starts with 'use server', so the route calls a server action, and in dev the action runs without the request's cookies. A production build is not affected.

Evidence, all on slot 5 with e2e/documents-upload.spec.ts through heavy.sh:

• At 2222cf2 with ESTA_E2E_SERVER=dev, rules 1, 5 and 7 fail with this error.
• At 5cf5982 with ESTA_E2E_SERVER=dev, the same three rules fail the same way.
• At 5cf5982 with ESTA_E2E_SERVER=build, all 11 tests pass in each of three runs.
• main has the same 'use server' file and the same route import.

Likely fix: move openDocument and signAndLog into a plain server-only module that both the route and the action import. Then add a dev-server run of rule 5 to the regression set.

Found while running the specs for #124 fix-forward 1. #124 changes nothing on this path.