Fix order cancellation logic and update tests to reflect new behavior

Adjusts the order cancellation endpoint to correctly handle admin overrides for completed/cancelled orders and updates associated tests to expect 409 status codes reflecting Task #80's changes.

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 77cfe984-2c65-4152-bb7a-0df28274fe66
Replit-Commit-Checkpoint-Type: full_checkpoint
Replit-Commit-Event-Id: d358e7e1-8a16-4746-86aa-4f1739233f2e
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/c3c252e4-c83d-40ca-9fff-99a3ea60701e/77cfe984-2c65-4152-bb7a-0df28274fe66/3E2mNig
Replit-Helium-Checkpoint-Created: true

artifacts/api-server/src/routes/service-orders.ts

@@ -384,8 +384,12 @@ router.patch(
       return;
     } else if (next === "cancelled") {
       // Check terminal state first so the receiver sees the right message
-      // regardless of permission gating order.
+      // regardless of permission gating order. Admin may still cancel a
-      if (existing.status === "cancelled" || existing.status === "completed") {
+      // completed/cancelled order (e.g. corrective action), so they bypass.
+      if (
+        !admin &&
+        (existing.status === "cancelled" || existing.status === "completed")
+      ) {
         res.status(409).json({ error: "order_unavailable" });
         return;
       }

artifacts/api-server/tests/service-orders.test.mjs

@@ -245,11 +245,11 @@ test("status transitions matrix: receiver flows + owner/admin cancel rules", asy
   assert.equal(res.status, 200);
   assert.equal((await res.json()).status, "completed");
 
-  // Cannot transition completed → anything (non-admin)
+  // Cannot transition completed → anything (non-admin); now 409 order_unavailable per Task #80
   res = await call(cr, "PATCH", `/orders/${order.id}/status`, {
     status: "preparing",
   });
-  assert.equal(res.status, 400);
+  assert.equal(res.status, 409);
 
   // Admin CAN cancel a completed order
   res = await call(ca, "PATCH", `/orders/${order.id}/status`, {