Templates: redesign to the v1 API contract + visual layout support

[chetanr25]

Templates: redesign to the v1 API contract + visual layout support

Implements the whole templates layer from the contract: a registry keyed by form_type holding field definitions, where each value comes from, and where each field sits on the page. Form generation and extraction validation both read this shape.

Closes #549. Also covers the field catalog and PDF flow from #609.

What this adds

• All 8 template endpoints from the contract.
• Every field declares a source, which decides what else it needs:
  • schema needs an incident mapping
  • static needs the text to print
  • manual needs neither, a person types it per incident
  • open needs a description, which is the instruction the model gets
• Fields carry a layout box in PDF points, so the visual editor and the backend agree on coordinates.
• GET /schema/fields returns every field in the incident contract with its path, type, aliases and PII flag. Built from the contract file itself, so it never drifts.
• Uploading a PDF returns page geometry straight away and runs field detection in the background. Each detected box comes back as an editable field with its position filled in and ranked mapping suggestions.
• A confident suggestion is applied for you. A weak one is only listed. A bad one is not shown at all, because a pre-filled mapping gets trusted more than it deserves.
• Detection failing is not fatal. The PDF and its geometry are still stored, the draft says what went wrong, and the editor falls back to drawing boxes by hand.

Endpoints

Method	Path	What it does
GET	/templates	list registered templates
POST	/templates	register one, 409 on duplicate form type
GET	/templates/{id}	full template
PUT	/templates/{id}	replace a template
GET	/templates/{id}/fields	fields only, with required_only
POST	/templates/pdf	store a PDF, return page sizes, queue detection
GET	/templates/pdf/{upload_id}	poll the detection draft
GET	/templates/{id}/pdf	download a template's source PDF
GET	/schema/fields	search the incident contract field catalog

Fix: #549
Part of: #541