Add UUID and metadata support for PDF signing

Enhanced PDF signing with UUID and metadata handling:
- Added `UUID` and `OriginalDocumentSha256` to `PdfSignOptionsDto` and `PdfSignatureCheckItemDto`.
- Introduced `BusinessReason` to separate metadata from signature reasons.
- Updated `PdfDigitalSignatureService` to embed and parse metadata in signature reasons.
- Improved error handling to include metadata in validation results.
- Updated `PdfSignatureController` to handle `UUID` in signing requests.

Refactored PKCS#11 configuration:
- Replaced `LibraryPath` with `AssetsRootPath` for asset resolution.
- Added `ProxySocket` and `DefaultApplicationName` options.
- Clarified runtime behavior for asset resolution in `README.md`.

Updated documentation and examples to reflect these changes.

EnvelopeGenerator.Infrastructure.Crypt/README.md

@@ -42,7 +42,8 @@ Supported deployment patterns:
 Critical platform rule:
 
 - A Windows process cannot load a Linux `.so` directly.
-- `Crypt:Pkcs11:LibraryPath` must always point to a native library compatible with the host OS of `EnvelopeGenerator.Server`.
+- `Crypt:Pkcs11:AssetsRootPath` must resolve to a directory that contains the expected native assets for the host OS.
+- If `AssetsRootPath` is empty, runtime resolves assets from `AppContext.BaseDirectory`.
 
 ---
 
@@ -104,14 +105,15 @@ Configuration section: `Crypt:Pkcs11`
 {
   "Crypt": {
     "Pkcs11": {
-      "LibraryPath": "/usr/lib/softhsm/libsofthsm2.so",
+      "AssetsRootPath": "E:\\DataFiles\\Digital Data\\EnvelopeGenerator",
       "SlotId": 1720207650,
       "TokenLabel": "DevToken",
+      "ProxySocket": "tcp://172.24.12.64:5657",
       "UserPin": "***",
       "PrivateKeyLabel": "sign-key",
-      "PrivateKeyIdHex": null,
       "CertificateLabel": "sign-cert",
-      "CertificateIdHex": null
+      "DefaultApplicationName": "signFLOW",
+      "UseUtcSigningTime": true
     }
   }
 }
@@ -139,7 +141,7 @@ Crypt tests read PKCS#11 values from `EnvelopeGenerator.Tests/appsettings.json`
 
 Required keys:
 
-- `Crypt:Pkcs11:LibraryPath`
+- `Crypt:Pkcs11:AssetsRootPath` (optional; if missing, app base directory is used)
 - `Crypt:Pkcs11:SlotId` (or `Crypt:Pkcs11:TokenLabel`)
 - `Crypt:Pkcs11:UserPin`
 - `Crypt:Pkcs11:PrivateKeyLabel`
@@ -371,11 +373,11 @@ Checkpoint:
 
 Server runtime (`EnvelopeGenerator.Server/EnvelopeGenerator.Server/appsettings.json`) must include:
 
-- `Crypt:Pkcs11:LibraryPath` = native PKCS#11 library path for the server host OS
-  - Windows host: Windows DLL path (vendor DLL or proxy client DLL)
-  - Linux host: Linux `.so` path
+- `Crypt:Pkcs11:AssetsRootPath` = base directory that contains `pkcs11\windows\proxy\libpkcs11-proxy.dll`
+  - If null/empty, runtime resolves assets from application output (`AppContext.BaseDirectory`)
 - `Crypt:Pkcs11:SlotId` = `2021549410` (or current company slot)
 - `Crypt:Pkcs11:TokenLabel` = `CompanyProdToken`
+- `Crypt:Pkcs11:ProxySocket` = `tcp://172.24.12.64:5657`
 - `Crypt:Pkcs11:UserPin` = real user pin
 - `Crypt:Pkcs11:PrivateKeyLabel` = `company-sign-key-v1`
 - `Crypt:Pkcs11:CertificateLabel` = `company-sign-cert-v1`