Public, unauthenticated. The actual signer (COSIGNER or INTERNAL only — CUSTOMER and a vestigial PRIMARY are explicitly rejected) submits their captured signature image, reached via the per-signer public_url/short-link emailed to them. Reuses the same multi-signer processing as the internal PATCH endpoint: the same AWAIT_SIGNATURE-only precondition, the same auto-approval rollup when every signer has signed. On error renders an HTML error card instead of a JSON error body.