feat(orders): «عدم سفارش» blocks app orders; import starts everyone allowed (MON-05)

Legacy stored customers.sts but no code read it, so the switch never
stopped an order, and 313 active customers carry it, mostly as the
sign-up default. Owner option 2: enforce it from now on, for orders
placed from the app only (an operator can still order for the
customer), and import every customer as allowed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/api/scripts/legacy-import/steps/people.ts

@@ -468,11 +468,17 @@ export async function customers(ctx: Ctx) {
       shopImageUrl: await ctx.imageUrl(r.shop_image_id, S),
       avatarFileId: await ctx.uploadedFile(r.image_id, 'legacy-avatar', S),
       birthDate: birthday(r.birth_date, r.created_at),
-      canPlaceOrders: int(r.sts) !== -1,
+      // Owner ruling 2026-10-08 (MON-05, option 2): everyone may order after the
+      // move. Legacy customers.sts was never read by any code — most of the 313
+      // «عدم سفارش» rows are just the sign-up default (ApiMobileController.php:704)
+      // — so carrying it over would suddenly block real customers once the new
+      // system enforces the switch. Only a deliberate suspension after go-live counts.
+      canPlaceOrders: true,
       isActive: int(r.active) !== -1,
       isArchived: int(r.is_archive) === 1,
     };
     if (r.reagent_id !== null && !owned.referredByAgentId) ctx.report.count(S, 'referrer not mapped (not a migrated expert)');
+    if (int(r.sts) === -1) ctx.report.count(S, 'legacy «عدم سفارش» (never enforced) — set to allowed (owner, option 2)');
     if (r.birth_date !== null && !owned.birthDate) ctx.report.count(S, 'birth date dropped (sign-up default or impossible)');
 
     const res = await upsert(ctx, 'customer', r.id, {