Bind Nova Poshta API key to cash register (#3)

Each cash register stores its own encrypted NP API key. Status polling uses
register keys and binds an order to the register whose key sees the TTN as
its own (PhoneSender present); ETTN receipts are created from that register.
Migration 0008 moves the old NOVA_POSHTA_API_KEY into the default register.

Closes #3

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

backend/tests/test_nova_poshta_client.py

@@ -8,7 +8,7 @@ import pytest
 import respx
 from httpx import Response
 
-from app.core.config import Settings
+from app.schemas.tracking import TrackingStatusOut
 from app.services.nova_poshta.client import NovaPoshtaError
 from app.services.nova_poshta.np_client import _API_URL, NpTrackingClient
 
@@ -27,12 +27,7 @@ STATUS_PAYLOAD = {
 }
 
 
-def _settings() -> Settings:
-    return Settings(
-        secret_key="test-secret-key",
-        encryption_key="dGVzdC1lbmNyeXB0aW9uLWtleS0zMi1ieXRlcyEh",
-        nova_poshta_api_key="np-apikey-123",
-    )  # type: ignore[arg-type]
+API_KEY = "np-apikey-123"
 
 
 class TestNpTrackingClientGetStatuses:
@@ -41,13 +36,13 @@ class TestNpTrackingClientGetStatuses:
         route = respx.post(_API_URL).mock(
             return_value=Response(200, json={"success": True, "data": [], "errors": []})
         )
-        client = NpTrackingClient(_settings())
+        client = NpTrackingClient()
 
-        await client.get_statuses(waybill_numbers=["20451540916703"])
+        await client.get_statuses(api_key=API_KEY, waybill_numbers=["20451540916703"])
 
         sent = route.calls.last.request
         body = json.loads(sent.content)
-        assert body["apiKey"] == "np-apikey-123"
+        assert body["apiKey"] == API_KEY
         assert body["modelName"] == "TrackingDocument"
         assert body["calledMethod"] == "getStatusDocuments"
         assert body["methodProperties"]["Documents"] == [
@@ -63,9 +58,9 @@ class TestNpTrackingClientGetStatuses:
                 200, json={"success": True, "data": [STATUS_PAYLOAD], "errors": []}
             )
         )
-        client = NpTrackingClient(_settings())
+        client = NpTrackingClient()
 
-        statuses = await client.get_statuses(waybill_numbers=["20451540916703"])
+        statuses = await client.get_statuses(api_key=API_KEY, waybill_numbers=["20451540916703"])
 
         assert len(statuses) == 1
         status = statuses[0]
@@ -75,6 +70,13 @@ class TestNpTrackingClientGetStatuses:
         # не "сколько заплатить сейчас" (`ExpressWaybillAmountToPay` = 827.48).
         assert status.cod_amount == "699"
         assert status.payment_status == "NeedPayment"
+        assert not status.is_own  # в STATUS_PAYLOAD нет PhoneSender
+
+    def test_is_own_by_sender_phone(self) -> None:
+        own = TrackingStatusOut.model_validate({**STATUS_PAYLOAD, "PhoneSender": "380961112233"})
+        foreign = TrackingStatusOut.model_validate({**STATUS_PAYLOAD, "PhoneSender": ""})
+        assert own.is_own
+        assert not foreign.is_own
 
     @respx.mock
     async def test_falls_back_to_amount_to_pay_when_afterpayment_missing(self) -> None:
@@ -82,9 +84,9 @@ class TestNpTrackingClientGetStatuses:
         respx.post(_API_URL).mock(
             return_value=Response(200, json={"success": True, "data": [payload], "errors": []})
         )
-        client = NpTrackingClient(_settings())
+        client = NpTrackingClient()
 
-        statuses = await client.get_statuses(waybill_numbers=["20451540916703"])
+        statuses = await client.get_statuses(api_key=API_KEY, waybill_numbers=["20451540916703"])
 
         assert statuses[0].cod_amount == "827.48"
 
@@ -95,18 +97,20 @@ class TestNpTrackingClientGetStatuses:
                 200, json={"success": False, "data": [], "errors": ["Invalid apiKey"]}
             )
         )
-        client = NpTrackingClient(_settings())
+        client = NpTrackingClient()
 
         with pytest.raises(NovaPoshtaError, match="Invalid apiKey"):
-            await client.get_statuses(waybill_numbers=["20451540916703"])
+            await client.get_statuses(api_key=API_KEY, waybill_numbers=["20451540916703"])
 
     async def test_returns_empty_list_for_no_documents(self) -> None:
-        client = NpTrackingClient(_settings())
+        client = NpTrackingClient()
 
-        assert await client.get_statuses(waybill_numbers=[]) == []
+        assert await client.get_statuses(api_key=API_KEY, waybill_numbers=[]) == []
 
     async def test_rejects_too_many_documents(self) -> None:
-        client = NpTrackingClient(_settings())
+        client = NpTrackingClient()
 
         with pytest.raises(NovaPoshtaError, match="Слишком много"):
-            await client.get_statuses(waybill_numbers=[str(i) for i in range(101)])
+            await client.get_statuses(
+                api_key=API_KEY, waybill_numbers=[str(i) for i in range(101)]
+            )