feat(orders): manual order PO attachment + price items (multipart)

Extend createOrder service to accept optional attachmentBuffer/attachmentName
parameters and persist them. Restructure the POST / multipart branch in the
orders route to dispatch on quotationId presence: from-quotation path is
unchanged, new manual-multipart path validates with CreateOrderSchema and
forwards the attachment. Add two TDD tests covering price line items and
PO file attachment storage.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/services/orders.service.ts

@@ -291,7 +291,11 @@ interface CreateOrderData {
   create_project?: boolean;
 }
 
-export async function createOrder(body: CreateOrderData) {
+export async function createOrder(
+  body: CreateOrderData,
+  attachmentBuffer?: Buffer | null,
+  attachmentName?: string | null,
+) {
   try {
     return await prisma.$transaction(async (tx) => {
       const orderNumber =
@@ -323,6 +327,10 @@ export async function createOrder(body: CreateOrderData) {
           scope_title: body.scope_title ?? null,
           scope_description: body.scope_description ?? null,
           notes: body.notes ?? null,
+          attachment_data: attachmentBuffer
+            ? new Uint8Array(attachmentBuffer)
+            : null,
+          attachment_name: attachmentName || null,
         },
       });