Fix structural annotation document visibility

[JSv4]

Motivation

• The explicit AnnotationType.resolve_document path (enabled by @bypass_get_queryset) could return a Document from a shared StructuralAnnotationSet without enforcing Document visibility, allowing private documents or signed URLs to leak when an unrelated shared document is visible.
• The unscoped annotations browsing path prefetched unfiltered structural-set documents, which could cause the resolver to pick an unauthorized document when the prefetch included private rows.

Description

• Update config/graphql/annotation_types.py::AnnotationType.resolve_document to gate returned documents through BaseService.filter_visible_qs(...) for the direct document_id case, the prefetched structural-set candidate list, and the fallback documents queryset so only visible documents are returned.
• Preserve deterministic/context-scoped ordering by intersecting the prefetched candidates with the permission-filtered set and returning the first visible prefetched document while keeping prefetch order.
• Add a regression in opencontractserver/tests/test_corpus_cards_structural_document_resolution.py that creates other_user and a private_doc that shares the same structural set and would sort first in an unscoped prefetch, along with _UNSCOPED_QUERY and test_unscoped_structural_resolution_skips_private_shared_documents to assert no private document is returned.

Testing

• Compiled the modified files with python -m compileall config/graphql/annotation_types.py opencontractserver/tests/test_corpus_cards_structural_document_resolution.py which succeeded.
• Attempted to run python -m pytest opencontractserver/tests/test_corpus_cards_structural_document_resolution.py -q but test execution was blocked by the environment due to ModuleNotFoundError: No module named 'django' so the new test was not executed here.
• The changes were committed as Fix structural annotation document visibility and include the code and test updates in the described files.

---

Codex Task

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!