Add CRM order queue: live sync, view modal, receipt tabs, delete

Wires the CRM (exoCRM GetOrders) into the dashboard as a locally
persisted order queue instead of the previous static mockup:

- CrmClient Protocol + ExoCrmClient/StubCrmClient for the CRM's
  signed JSON-RPC API
- Order model + migration, synced from CRM on each queue view;
  soft-deleted orders stay hidden across re-syncs
- GET/DELETE /api/v1/orders with "no receipt"/"receipt issued" tabs
  (the latter is empty until Checkbox fiscalization lands)
- Dashboard: real order list, item-detail modal, tab switcher,
  one-click delete

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/app/api/deps.py

@@ -10,9 +10,12 @@ from fastapi import Depends, HTTPException, status
 from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from app.core.config import settings
 from app.core.security import TokenError, decode_access_token
 from app.db.models.user import User, UserRole
 from app.db.session import get_session
+from app.services.crm.client import CrmClient
+from app.services.crm.exo_client import ExoCrmClient
 
 bearer_scheme = HTTPBearer(auto_error=False)
 
@@ -85,3 +88,10 @@ require_any = require_roles(UserRole.ADMIN, UserRole.CASHIER, UserRole.VIEWER)
 
 AdminUser = Annotated[User, Depends(require_admin)]
 CashierUser = Annotated[User, Depends(require_cashier)]
+
+
+def get_crm_client() -> CrmClient:
+    return ExoCrmClient(settings)
+
+
+CrmClientDep = Annotated[CrmClient, Depends(get_crm_client)]

backend/app/api/v1/orders.py

@@ -0,0 +1,43 @@
+"""Локальная очередь заказов (синхронизируется из CRM) — список, вкладки, удаление."""
+
+from __future__ import annotations
+
+from fastapi import APIRouter, Depends, HTTPException, Request, status
+
+from app.api.deps import CashierUser, CrmClientDep, SessionDep, require_any
+from app.db.models.audit import AuditAction
+from app.schemas.orders import OrderRowOut
+from app.services import audit
+from app.services import orders as orders_service
+
+router = APIRouter(prefix="/orders", tags=["orders"], dependencies=[Depends(require_any)])
+
+
+@router.get("", response_model=list[OrderRowOut], response_model_by_alias=False)
+async def list_orders(
+    session: SessionDep, crm: CrmClientDep, has_receipt: bool = False
+) -> list[OrderRowOut]:
+    # by_alias=False: без этого FastAPI сериализует вложенные OrderGoodOut через
+    # CRM-алиасы (SKU/Name/...) вместо snake_case полей, которые ждёт фронтенд.
+    await orders_service.sync_orders_from_crm(session, crm)
+    orders = await orders_service.list_orders(session, has_receipt=has_receipt)
+    return [OrderRowOut.from_order(order) for order in orders]
+
+
+@router.delete("/{order_id}", status_code=status.HTTP_204_NO_CONTENT)
+async def delete_order(
+    order_id: str, request: Request, session: SessionDep, actor: CashierUser
+) -> None:
+    order = await orders_service.delete_order(session, order_id)
+    if order is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Заказ не найден")
+
+    await audit.record(
+        session,
+        action=AuditAction.ORDER_DELETED,
+        user=actor,
+        entity_type="order",
+        entity_id=order.id,
+        request=request,
+    )
+    await session.commit()

backend/app/api/v1/router.py

@@ -2,9 +2,10 @@
 
 from fastapi import APIRouter
 
-from app.api.v1 import auth, health, users
+from app.api.v1 import auth, health, orders, users
 
 api_router = APIRouter()
 api_router.include_router(health.router)
 api_router.include_router(auth.router)
 api_router.include_router(users.router)
+api_router.include_router(orders.router)