feat(geoportal-v2): export toolbar + Semnez ca picker + CF intern/Extras split

V2 panel toolbar replaces the single "Comandă CF" button with two rows:

  [Încadrare] [Pl. situație] [Coord.] [DXF]       ← 4 exports
  [CF intern] [Extras CF]                          ← 2 CF flows

Each export button pops an inline modal:
  - PIZ / PAD: SignAsPicker (PFA / PJA radio list, manual-add inline,
    co-signer slot on PIZ) + basemap toggle (google / orto for PIZ).
  - Coord / DXF: no picker — single-click download via JWT proxy.

"CF intern" is the free copycf flow from eTerra (proxied via gis-api);
"Extras CF" keeps the existing CfOrderModal (1 credit ePay). The two
modes are now visually balanced as a 2-button row.

Sign-as picker rows merge user-owned Signatory table entries with the
SIGN_AS_DEFAULT_OPTIONS env-driven fallback (org-wide hardcoded options;
defaults seed two Studii de teren entries — Tiurbe PFA + SRL PJA). New
rows added via the picker's "Adaugă autorizație" inline form write to
the Signatory table; ENV rows are read-only.

Architots side ships fully:
  - prisma Signatory model + ALTER TABLE applied (per the schema-drift
    feedback memory).
  - /api/sign-as-options (GET, POST) + /api/sign-as-options/[id]
    (PATCH, DELETE).
  - /api/cf-intern/order and /api/gis/parcel/[id]/{piz,pad,coords,dxf}
    proxy routes — auth check + JWT forward, stream binary back.
  - gis-api thin client extended with the matching exports.* namespace.

Until the gis-api endpoints ship (next session — full spec in
docs/plans/005-gis-api-export-endpoints.md), each export proxy returns
501 "…urmează" with a Romanian message so the modal shows what's
coming instead of a hard error.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

prisma/schema.prisma

@@ -202,3 +202,25 @@ model CfExtract {
   @@index([userId])
   @@index([userId, nrCadastral])
 }
+
+// ─── Geoportal Exports: Signatories (PIZ/PAD "Semnez ca:") ─────────
+// Each row is an authorisation a user can sign exports with: themselves
+// as a PFA (kind=user) or on behalf of an org/PJA (kind=org). The picker
+// merges these rows with the SIGN_AS_DEFAULT_OPTIONS env-driven fallback
+// (hardcoded org-wide entries) so a fresh install has usable defaults
+// before anyone configures their own.
+model Signatory {
+  id          String   @id @default(uuid())
+  userId      String /// Authentik sub of the owner
+  kind        String /// 'user' | 'org'
+  displayName String /// "Dan-Gheorghe Tiurbe" or "Studii de teren SRL"
+  authClass   String? /// "Cat. D" / "Clasa III"
+  authNumber  String /// "RO-B-F/3183"
+  isDefault   Boolean  @default(false) /// primary signer for this user
+  notes       String?
+  createdAt   DateTime @default(now())
+  updatedAt   DateTime @updatedAt
+
+  @@index([userId])
+  @@index([userId, isDefault])
+}