Add two internal endpoints so an embedding app can run one DocuSeal
account per tenant, authenticated entirely by tokens (no shared Devise
admin session):
- POST /api/internal/provision_account — HMAC-signed (DOCUSEAL_PROVISION_SECRET)
handoff that idempotently creates an Account + owner User + access token
and returns them. Fails closed when the secret is unset.
- POST /api/internal/templates — X-Auth-Token-authed create-from-PDF that
builds a template under the caller's account via the same service the web
uploader uses, idempotent by external_id (scoped per account).
EmbedBuilderController/EmbedScoped already scope to user.account.templates,
so giving each tenant its own account makes that a real isolation boundary.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>