W165: Upload document

Streams the uploaded bytes to GCS and inserts the org.documents row. Triggered from the documents section of an order detail page (Sales Order detail today; PO / WO UI tracked in #574).

Steps

1. Validate the parent. Dispatch on entityType: PurchaseOrders.getPoById / WorkOrders.getWoById / SalesOrders.getSoById. 404 when the id doesn't resolve in the caller's org.
2. Create the document. Call Documents.create(input, bytes) — uploads to GCS first, then inserts the row; if the insert fails, L2 deletes the GCS object before re-raising (atomic within L2).

Returns

The created Document row.

Business rules

• A document belongs to exactly one parent and is never shared or relinked.
• The GCS path is org-scoped (orgs/<orgId>/…) and salted with a UUID; the original filename is sanitized but preserved for display.

Errors

Condition	Error
Parent (entityType, entityId) not found in this org	not_found