Submit Endpoint

POST /submit body — the intake plus the verdicts already gathered.

Verdicts come from prior /validate-document calls; the server does NOT re-validate on submit (the files are gone — that's the validate-don't-retain consequence). What it does do is check that each verdict is one it issued: document_tokens carries, under the same key, the signed token that came back with the verdict, and a verdict without a valid one is refused (#598).