Task #62: Service Orders backend foundation (corrected)

After prior code review rejection, refactored to match spec exactly:
- Permission renamed orders:receive → orders.receive (dot form), seeded with order_receiver role
- service_orders table: user_id, service_id, notes, status (pending/received/preparing/completed/cancelled with CHECK), assigned_to, created_at, updated_at
- /confirm-receipt is now the receiver atomic claim (UPDATE WHERE pending+unassigned), 409 already_claimed on miss
- /status accepts preparing|completed|cancelled with permission matrix:
  * preparing/completed: assigned receiver or admin
  * cancelled: owner (pending|received) OR admin (any non-cancelled status)
- requirePermission middleware no longer auto-bypasses admin; admin gets the permission via explicit seed grant
- Notifications use type='order', relatedType='order'
- Realtime emits notification_created (per receiver) + order_incoming_changed (broadcast) + order_updated (owner)
- OpenAPI Order schema rewritten (no quantity, no per-status timestamps), endpoint summaries updated, codegen run
- Tests cover: client place+list, non-receiver 403, no-role 403, parallel claim race (200/409), status matrix, owner-cancel rules, admin-cancel-completed, descriptions excluded from service summary

All 24 api-server tests pass. Ready for code review re-check.

lib/db/src/schema/service-orders.ts

@@ -1,31 +1,34 @@
-import { pgTable, text, serial, timestamp, integer, varchar } from "drizzle-orm/pg-core";
+import { pgTable, text, serial, timestamp, integer, varchar, check } from "drizzle-orm/pg-core";
+import { sql } from "drizzle-orm";
 import { createInsertSchema } from "drizzle-zod";
 import { z } from "zod/v4";
 import { usersTable } from "./users";
 import { servicesTable } from "./services";
 
-export const serviceOrdersTable = pgTable("service_orders", {
-  id: serial("id").primaryKey(),
-  serviceId: integer("service_id").notNull().references(() => servicesTable.id, { onDelete: "restrict" }),
-  requestedBy: integer("requested_by").notNull().references(() => usersTable.id, { onDelete: "cascade" }),
-  assignedTo: integer("assigned_to").references(() => usersTable.id, { onDelete: "set null" }),
-  quantity: integer("quantity").notNull().default(1),
-  notes: text("notes"),
-  status: varchar("status", { length: 30 }).notNull().default("pending"),
-  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
-  claimedAt: timestamp("claimed_at", { withTimezone: true }),
-  deliveredAt: timestamp("delivered_at", { withTimezone: true }),
-  receivedAt: timestamp("received_at", { withTimezone: true }),
-  cancelledAt: timestamp("cancelled_at", { withTimezone: true }),
-});
+export const serviceOrdersTable = pgTable(
+  "service_orders",
+  {
+    id: serial("id").primaryKey(),
+    userId: integer("user_id").notNull().references(() => usersTable.id, { onDelete: "cascade" }),
+    serviceId: integer("service_id").notNull().references(() => servicesTable.id, { onDelete: "restrict" }),
+    notes: text("notes"),
+    status: varchar("status", { length: 20 }).notNull().default("pending"),
+    assignedTo: integer("assigned_to").references(() => usersTable.id, { onDelete: "set null" }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow().$onUpdate(() => new Date()),
+  },
+  (t) => [
+    check(
+      "service_orders_status_check",
+      sql`${t.status} IN ('pending','received','preparing','completed','cancelled')`,
+    ),
+  ],
+);
 
 export const insertServiceOrderSchema = createInsertSchema(serviceOrdersTable).omit({
   id: true,
   createdAt: true,
-  claimedAt: true,
-  deliveredAt: true,
-  receivedAt: true,
-  cancelledAt: true,
+  updatedAt: true,
   status: true,
   assignedTo: true,
 });
@@ -34,9 +37,9 @@ export type ServiceOrder = typeof serviceOrdersTable.$inferSelect;
 
 export const SERVICE_ORDER_STATUSES = [
   "pending",
-  "claimed",
-  "delivered",
   "received",
+  "preparing",
+  "completed",
   "cancelled",
 ] as const;
 export type ServiceOrderStatus = (typeof SERVICE_ORDER_STATUSES)[number];