fix(orders): release PO number against creation year; tighten sort-dir + enum typing

Addresses review of the issued-orders service: deleteIssuedOrder now derives the release year from created_at (cross-year deletes reclaim the right sequence); list sort direction is normalized to asc/desc; status cast uses $Enums instead of as-never. Adds a cross-year delete test.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/services/issued-orders.service.ts

@@ -1,3 +1,4 @@
+import type { $Enums } from "@prisma/client";
 import prisma from "../config/database";
 import {
   generateIssuedOrderNumber,
@@ -106,10 +107,12 @@ export async function listIssuedOrders(params: ListIssuedOrdersParams) {
     ];
   }
 
+  // Normalize the direction so an unexpected value can't reach Prisma at runtime.
+  const dir: "asc" | "desc" = order === "asc" ? "asc" : "desc";
   // Tiebreak on id so same-day order_date rows sort deterministically.
-  const orderBy: Record<string, string>[] = [
-    { [sortField]: order },
-    { id: order },
+  const orderBy: Record<string, "asc" | "desc">[] = [
+    { [sortField]: dir },
+    { id: dir },
   ];
 
   const [rows, total] = await Promise.all([
@@ -176,7 +179,9 @@ export async function createIssuedOrder(body: IssuedOrderInput) {
       data: {
         po_number: poNumber,
         customer_id: body.customer_id ? Number(body.customer_id) : null,
-        status: (body.status ? String(body.status) : "draft") as never,
+        status: (body.status
+          ? String(body.status)
+          : "draft") as $Enums.issued_orders_status,
         currency: body.currency ? String(body.currency) : "CZK",
         vat_rate: body.vat_rate != null ? Number(body.vat_rate) : 21.0,
         apply_vat: body.apply_vat !== false,
@@ -306,10 +311,13 @@ export async function deleteIssuedOrder(id: number) {
   const existing = await prisma.issued_orders.findUnique({ where: { id } });
   if (!existing) return null;
   await prisma.issued_orders.delete({ where: { id } });
-  await releaseIssuedOrderNumber(
-    new Date().getFullYear(),
-    existing.po_number ?? undefined,
-  );
+  // Reclaim the number against the year it was allocated in (the creation year),
+  // not the current year — a cross-year delete must release the right sequence
+  // or the number is never freed.
+  const year = existing.created_at
+    ? new Date(existing.created_at).getFullYear()
+    : new Date().getFullYear();
+  await releaseIssuedOrderNumber(year, existing.po_number ?? undefined);
   return existing;
 }