feat: implement DocuSeal real e-signature provider (issue #23)

.env.example

@@ -181,3 +181,30 @@ LOCAL_STORAGE_DIR=/tmp/shelterflex-dev
 # S3_SECRET_ACCESS_KEY=
 # S3_ENDPOINT=  # For MinIO: http://localhost:9000
 # S3_FORCE_PATH_STYLE=true  # Set to true for MinIO
+
+# ---------------------------------------------------------------------------
+# E-Signature provider (lease agreements)
+# ---------------------------------------------------------------------------
+# [OPTIONAL] Provider to use for lease e-signatures.
+#   stub    – in-memory provider, no external calls (default).
+#   docuseal – real DocuSeal-backed provider (self-hosted or cloud).
+ESIGN_PROVIDER=stub
+
+# [REQUIRED when ESIGN_PROVIDER=docuseal] DocuSeal base URL.
+# For self-hosted: http://localhost:3000
+# For DocuSeal cloud: https://api.docuseal.com
+DOCUSEAL_API_URL=http://localhost:3000
+
+# [REQUIRED when ESIGN_PROVIDER=docuseal] DocuSeal API auth token.
+# Generate in DocuSeal dashboard → Settings → API.
+DOCUSEAL_API_KEY=
+
+# [REQUIRED when ESIGN_PROVIDER=docuseal] Shared secret for verifying inbound
+# webhook signatures (HMAC-SHA-256).  Set this in DocuSeal webhook settings
+# and mirror the value here.  Generate with:
+#   node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
+DOCUSEAL_WEBHOOK_SECRET=
+
+# Feature flag — lease agreement generation + e-signature workflow.
+# Set to true to enable the lease signing endpoints.
+FEATURE_FLAG_LEASE_AGREEMENTS_ENABLED=false