Documents

One flat, polymorphic attachment surface for every document-bearing entity (purchase orders, work orders, and sales orders today). A document belongs to exactly one parent, addressed by entityType + entityId in the request instead of the URL path; the domain replaces the nine nested per-parent endpoints, and E167 adds the previously missing signed-URL download.

Endpoints E165–E168. Each maps 1:1 to the L3 workflow with the same number — see the master endpoints table for the flat view.

The web client wires documents into Sales Order detail only for now — the PO / WO documents UI is tracked in issue #574.

Writes

• E165 POST /documents — Upload document → W165
• E168 DELETE /documents/:id — Delete document → W168

Reads

• E166 GET /documents?entityType=&entityId= — List documents for an entity → W166
• E167 GET /documents/:id — Get document detail (signed download URL) → W167