feat(woo): mark an order as already booked outside the integration (#1895)

* feat(woo): mark an order as already booked outside the integration

Orders booked by hand before the store was connected sat under Att
bokfora forever: the only exits were the book and create-invoice routes.

- Migration: manually_booked_at/_by + optional
  manually_booked_journal_entry_id on webshop_orders (informational link,
  no financial freeze; the mark produced no accounting objects).
- POST/DELETE /api/webshop-orders/[id]/mark-booked: mark with optional
  posted-verifikat reference (validated per company), conditional claim
  against concurrent booking/invoicing; unmark is a plain revert.
- book and create-invoice routes refuse marked rows (409
  WEBSHOP_ORDER_MANUALLY_BOOKED) and exclude them in their atomic claims.
- List route: booked/unbooked filters treat a manual mark as a closed
  exit, so marked rows leave the Att bokfora tab and join Bokforda.
- Orders page: row overflow menu with Markera som bokford / Angra
  markering, MarkOrderBookedDialog with a searchable candidate list of
  posted entries near the order date, muted status text linking to the
  referenced verifikat.

Fixes #1879

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(woo): close skeptic findings on the manual-booked mark

- mark-booked applies the same open-twin gate as book/create-invoice:
  an OPEN legacy feed transaction blocks the mark (409
  WEBSHOP_ORDER_LEGACY_TRANSACTION_OPEN); ignored or booked feed rows
  unlock it, so no open path to a duplicate remains.
- ingest treats manually marked rows as frozen for drift purposes:
  remote financial deltas set remote_changed_after_freeze (same badge as
  booked rows) instead of silently refreshing the row under the user's
  assertion.
- re-marking with a journal_entry_id updates the informational link
  instead of silently dropping it.
- dialog: candidate amount computed from the returned lines (the list
  API does not return total_amount), newest-first ordering, cap hint.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* chore(migrations): bump webshop manual-booking migration past freshly merged 20260825120000

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(woo): resolve PR review findings in one pass

- freeze v3 migration: financial fields are frozen at the DB level while
  a row is manually marked as booked (review finding: the mark's freeze
  lived only in ingest.ts, so any other write path could silently mutate
  a marked row); unmark stays the escape hatch. pg test added.
- pass the active locale to getErrorMessage in the orders page and
  MarkOrderBookedDialog (CodeRabbit: English users got Swedish errors).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

tests/pg/webshop-orders.pg.test.ts

@@ -191,6 +191,60 @@ describe('webshop_orders financial freeze', () => {
     expect(ok.rowCount).toBe(1)
   })
 
+  it('freezes financial fields while manually marked as booked; unmark restores mutability (#1879, freeze v3)', async () => {
+    const { userId, companyId } = await seedCompany()
+    const rowId = await insertOrderRow({ companyId, userId })
+
+    // Mark as booked outside the integration (what the mark-booked route does).
+    const marked = await getPool().query(
+      `UPDATE public.webshop_orders
+         SET manually_booked_at = now(), manually_booked_by = $2
+       WHERE id = $1`,
+      [rowId, userId],
+    )
+    expect(marked.rowCount).toBe(1)
+
+    // Financial fields are frozen at the DB level while marked.
+    await expect(
+      getPool().query(
+        `UPDATE public.webshop_orders SET total = 600.00 WHERE id = $1`,
+        [rowId],
+      ),
+    ).rejects.toThrow(/financial fields are frozen/i)
+    await expect(
+      getPool().query(
+        `UPDATE public.webshop_orders SET line_items = '[{"name":"x"}]'::jsonb WHERE id = $1`,
+        [rowId],
+      ),
+    ).rejects.toThrow(/financial fields are frozen/i)
+
+    // Safe sync fields still pass (drift flagging keeps working).
+    const safe = await getPool().query(
+      `UPDATE public.webshop_orders
+         SET status = 'completed', remote_changed_after_freeze = true
+       WHERE id = $1`,
+      [rowId],
+    )
+    expect(safe.rowCount).toBe(1)
+
+    // Unmark (the DELETE route) is the escape hatch...
+    const unmark = await getPool().query(
+      `UPDATE public.webshop_orders
+         SET manually_booked_at = NULL, manually_booked_by = NULL,
+             manually_booked_journal_entry_id = NULL
+       WHERE id = $1`,
+      [rowId],
+    )
+    expect(unmark.rowCount).toBe(1)
+
+    // ...after which the row is fully mutable again.
+    const thawed = await getPool().query(
+      `UPDATE public.webshop_orders SET total = 600.00, total_sek = 600.00 WHERE id = $1`,
+      [rowId],
+    )
+    expect(thawed.rowCount).toBe(1)
+  })
+
   it('rejects clearing the journal link once the entry is posted', async () => {
     const { userId, companyId, fiscalPeriodId } = await seedCompany()
     const postedId = await insertDraftJournalEntry({