Store disclaimer acceptance on its own field and simplify submit path

[nonprofittechy]

Follow-up cleanup to #268 (court disclaimers), from a /simplify review.

Changes

• Acceptance record: new FilingDraft.disclaimer_acceptance field (migration 0027). It's written in the same update that claims the draft for submission, so it only lands if the claim wins. It no longer lives in supplemental_fields, which is copied into case_data. Correction drafts start without it, so the filer accepts again.
• Submit path: the body is parsed once. session_api.submit_final_filing becomes forward_final_filing(request, data), which only the wrapper calls, and its duplicate confirmation check is removed, along with the unused CONFIRMATION_REQUIRED error code. The dead draft is not None guards in the wrapper are gone.
• Court text: the proxy's \"/\n escapes are undone when requirements are parsed, so the text shown, signed and stored is the same. disclaimer_html now only sanitizes, reuses the md_to_html allowlists, and is memoized.
• Caching: Review caches court requirements for 10 minutes. Submit always rechecks live, and that recheck refreshes the cache, so after a text change a reload shows the new text straight away.
• JS: one filingConfirmed() check for the attestation checkbox.
• Tests: one shared court_requirements stub in conftest.py and an accepted_submission() helper replace the per-file copies. New tests cover the escape cleanup and cache behavior.

Notes for review

• The cache is Django's default local-memory cache, which is per process. With several workers, a worker that didn't handle the failed submit can show old text for up to 10 minutes after the court changes it. Submit always checks live, so no one can accept outdated text.

Testing

• pytest: 1143 passed. ruff, ty and makemigrations --check are clean. JS unit tests: 64 passed, and ESLint is clean.
• End to end against the staging EFSP and Tyler's Illinois test environment (Adams County, fee-waiver payment):
  • The upload page showed the statewide notices.
  • Review showed the sanitized court requirements with the acceptance checkbox.
  • A forged token was rejected with a 400.
  • The filing was submitted (envelope 324444), and disclaimer_acceptance was recorded with both requirement codes.
  • The "pay" test account was declined by Tyler. That's unrelated to this change.

🤖 Generated with Claude Code