feat(orders): issued-order PDF export route

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/__tests__/issued-orders.test.ts

@@ -13,6 +13,7 @@ import {
   updateIssuedOrder,
   deleteIssuedOrder,
 } from "../services/issued-orders.service";
+import { renderIssuedOrderHtml } from "../routes/admin/issued-orders-pdf";
 
 afterEach(async () => {
   await prisma.number_sequences.deleteMany({ where: { type: "issued_order" } });
@@ -217,3 +218,48 @@ describe("deleteIssuedOrder", () => {
     expect(seq?.last_number).toBe(0);
   });
 });
+
+describe("renderIssuedOrderHtml", () => {
+  const order = {
+    po_number: "26720001",
+    order_date: new Date("2026-06-09T12:00:00"),
+    delivery_date: null,
+    currency: "CZK",
+    apply_vat: true,
+    vat_rate: 21,
+    notes: "<p>Pozn</p><script>alert(1)</script>",
+    delivery_terms: null,
+    payment_terms: null,
+    issued_by: null,
+  };
+  const items = [
+    {
+      description: "Materiál",
+      item_description: null,
+      quantity: 2,
+      unit: "ks",
+      unit_price: 100,
+      vat_rate: 21,
+    },
+  ];
+
+  it("renders the PO number, items, and both party names", () => {
+    const html = renderIssuedOrderHtml(
+      order,
+      items,
+      { name: "Dodavatel" },
+      { company_name: "Naše firma" },
+      "cs",
+    );
+    expect(html).toContain("26720001");
+    expect(html).toContain("Materiál");
+    expect(html).toContain("Dodavatel");
+    expect(html).toContain("Naše firma");
+  });
+
+  it("strips script tags from notes", () => {
+    const html = renderIssuedOrderHtml(order, items, null, null, "cs");
+    expect(html).not.toContain("<script>");
+    expect(html).not.toContain("alert(1)");
+  });
+});