Fix PandaDoc webhook: fetch fields via API and create applications

[rayyanmridha]

Summary

• Root cause: PandaDoc webhooks only send event metadata (doc ID, event type) — not form field values. The handler was trying to read fields directly from the webhook payload, which never worked.
• Fix: Receive webhook → extract document ID → call PandaDoc fields API (`GET /documents/{id}/fields`) → map fields → create Application + CandidateInfo + LearnerInfo in a transaction.
• Field mapping fixes discovered by testing against all 8 completed real documents:
  • Map by `field_id` (semantic, e.g. `Volunteer_Pronouns`) not `name` (generic type, e.g. `"Text"`)
  • Inject `email` and `phone` from recipient `assigned_to` metadata — they are not form fields
  • Coalesce upload slots: `*1` = supervisor flow, `*2` = applicant self-submission; fall back to `*1` when `*2` is empty
  • Normalize `Volunteer_Discipline` label → kebab-case key to satisfy the `discipline` catalog FK
  • Make `Volunteer_Phone` optional — the form label exists but no input field is wired in the current PandaDoc template
  • Convert missing-required-fields mapper errors to 400 Bad Request (were incorrectly 500)
• Names fix: The admin UI was showing raw email addresses instead of applicant names. Root cause: the webhook never created a `User` record, and the frontend resolves display names via the `users` table (`useApplications.ts`). Fix: extract `first_name`/`last_name` from PandaDoc recipient `assigned_to` metadata (same source as email/phone) and create a `User` row inside the same transaction — only if one doesn't already exist for that email.

Test plan

• Fired a signed webhook locally against a real completed PandaDoc document (juCyjmgFCMLTNrfBbxfate). Confirmed all four records created atomically: Application (appId=46), CandidateInfo, LearnerInfo, and User (firstName=Sam, lastName=Nie)
• All 6 real completed PandaDoc submissions create applications successfully (tested locally: appIds created for supervisor flow docs and applicant self-submission docs)
• 2 blank/junk test forms correctly return 400 Bad Request with field names listed
• HMAC-SHA256 signature verification still works (existing guard tests pass)
• 22 pandadoc unit tests pass (including 3 new tests for user creation: creates user when name present, skips when no name, skips when user already exists)
• PANDADOC_API_KEY must be set in ECS environment (confirm with Sam — believed already present)