feat(f6.8): harden offline field flow and act documents

api-v3/src/inspection-findings/inspection-evidence.service.ts

@@ -153,6 +153,22 @@ export class InspectionEvidenceService {
       assertMobileInspector(principal);
     }
     this.validateCoordinates(dto.latitude, dto.longitude, dto.accuracyM);
+    if (dto.operationId) {
+      const [existing] = await this.dataSource.query(
+        `${this.evidenceSelect()} WHERE evidence.client_operation_id = $1`,
+        [dto.operationId],
+      ) as StoredInspectionEvidence[];
+      if (existing) {
+        if (existing.findingId !== findingId) {
+          throw new ConflictException({
+            code: 'INSPECTION_EVIDENCE_OPERATION_REUSED',
+            message: 'La operación offline ya fue utilizada para otra evidencia',
+          });
+        }
+        const { storedName: _storedName, ...view } = existing;
+        return view;
+      }
+    }
     const inspected = inspectInspectionEvidenceFile(file, dto.kind);
     this.validatePurpose(dto, inspected.mimeType);
 
@@ -210,12 +226,12 @@ export class InspectionEvidenceService {
             id, finding_id, communication_id, verification_visit_id, kind, purpose,
             original_name, stored_name, mime_type, size_bytes, sha256,
             title, description, captured_at, latitude, longitude, accuracy_m,
-            device_label, source, uploaded_by
+            device_label, source, uploaded_by, client_operation_id
           ) VALUES (
             $1, $2, $3, $4, $5, $6,
             $7, $8, $9, $10, $11,
             $12, $13, $14, $15, $16, $17,
-            $18, $19, $20
+            $18, $19, $20, $21
           )
         `, [
           id,
@@ -238,6 +254,7 @@ export class InspectionEvidenceService {
           dto.deviceLabel?.trim() || null,
           source,
           principal.userId,
+          dto.operationId ?? null,
         ]);
         const created = await this.loadEvidence(manager, id);
         await this.audit.record({