E-signature sign-off & record immutability

Defines sign-off requirements per study, captures electronic signatures with a password re-authentication step, and — the moment the first required signer signs — freezes the study content read-only and hard-locks every write endpoint (409 on further edits), so a signed record can never be silently altered underneath its own approval.

• A completed hazard study needs a formal, auditable approval before it governs a design.
• You need to guarantee a signed study genuinely cannot change afterward — not just discourage it.

The first qualifying signature flips the study read-only study-wide; every content-write API call thereafter returns a hard 409, enforced server-side so it can't be bypassed from the UI. The signed PDF/Word export carries a Signatures appendix (signer, role, timestamp, hash-prefix) that travels with the document.