fix(admin-panel): retail order status editing posted a body with no orderId

views/order/List.vue handed the timeline activity entry straight to
single/order-sts/edit. That entry is {status, title, proceed, uaj, note} and has
no order id, so UpdateOrderStatusDto rejected every call with 400 — neither
"ثبت وضعیت" nor "حذف وضعیت" worked on the retail order screen. Both handlers now
take the id from tempRow, matching OmdeList.vue and TaminList.vue, which were
already correct.

Found by the new scripts/smoke-admin.cjs (43/43), which walks login, customer
create, sales-expert create/edit, product+variant create/edit and order
list/detail/status, asserting the database changed rather than trusting a 200.

[ref: henza_server/routes/admin.php:59]

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/parity/CHANGELOG.md

@@ -611,3 +611,29 @@ appeared instead of an error — no operation was blocked (D20).
 **Data touched:** `test-master-otp-disabled.cjs` deletes the `CustomerOtp` rows
 **for its own test number only** (to clear the 60s resend cooldown); 1 row was
 deleted on the recorded run. No other data was created, changed or removed.
+
+### Admin smoke test + a real bug it caught (D19 step 3)
+
+New `apps/api/scripts/smoke-admin.cjs` — **43/43**. Walks the flows the owner
+listed: login → create a customer → create and edit a sales expert → create and
+edit a product with variants → list, view and change an order's status. Each
+step asserts the DATABASE changed, not just that the call returned 200.
+
+**ORD-01 (fixed) — retail order status editing was completely broken.**
+`views/order/List.vue:203,215` posted the timeline ACTIVITY entry straight to
+`single/order-sts/edit`. That object is `{status, title, proceed, uaj, note}`
+(`admin-orders.service.ts:249-258`) and carries **no order id**, so
+`UpdateOrderStatusDto` rejected every call with 400: neither «ثبت وضعیت» nor
+«حذف وضعیت» worked on that screen. Both handlers now build the body from
+`tempRow.id`, the order loaded when the dialog opens — the shape `OmdeList.vue:187`
+and `TaminList.vue:169,184` already used. Those two screens were checked and
+were already correct; `List.vue` was the only broken caller.
+
+Two assertions in the first draft of the smoke test were wrong, not the product:
+the product form reads `variants_all` (not `variants`), and the status endpoint
+takes `orderId` (not `id`/`sts`). Both corrected.
+
+**Data touched:** the script creates and then deletes its own rows only
+(1 product + its variants/images, 1 admin user + profile, 2 customers per run).
+The order status change is made against an existing order and then **restored to
+its original value** in the same run; no pre-existing row is left modified.