test(api): B2B admin scan + write-path smoke, both green

scan-admin-b2b.cjs (34 ok, 0 broken) hits every read endpoint the wholesale desk
uses daily. smoke-admin-b2b-writes.cjs (25/25) covers the money-touching writes:
admin order placement and a cash payment document, asserting the ledger and the
customer balance rather than the HTTP status.

Verified: the making charge computes exactly, a document is created unconfirmed,
confirming moves the gold debt, and confirming again toggles back and restores
the balance to the byte.

Retail/storefront surfaces were deliberately not scanned (D13).

No B2B breakage found. Three first-draft failures were test bugs, corrected
against the real callers: cities/list -> admin/cities/list, by-ids takes
products_id, and document type 4 is cash (2 is a transfer).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/parity/CHANGELOG.md

@@ -692,3 +692,40 @@ page that is actually being demonstrated. Listed under known issues.
 
 **Data touched:** the script creates one order and deletes it again, with its
 items, status events and ledger entries. No pre-existing data is modified.
+
+## 2026-09-23 — B2B admin scan (D19 step 2)
+
+Two new scripts, scoped to the B2B surfaces the owner named. Retail/storefront
+(`single*`, wallet, comments) was **not** scanned — D13, preserved untouched.
+
+**`scripts/scan-admin-b2b.cjs` — 34 ok, 0 broken.** Every read endpoint the
+wholesale desk opens daily: the five customer grids, the referrer dropdown,
+customer detail/dashboard/orders/documents, the sales-expert list and detail,
+products, variants, brands, collections, product detail and its variants,
+wholesale and tamin order grids, order detail, the documents grid and detail,
+and the supporting lookups (cities, branches, workshops, pre-orders, users).
+
+**`scripts/smoke-admin-b2b-writes.cjs` — 25/25.** The money-touching writes a
+read-only scan cannot cover:
+
+- Placing a wholesale order from the admin panel: the making charge computes
+  exactly (`8.133g +2% = 8.2957` per unit, ×2 = `16.5913` total), the order
+  lands on the right customer and appears in the grid with a status timeline.
+- Recording a cash payment document: the reference's formula
+  `price / (price_per_gram / 4.331802)` gives 0.8664g, the entry is created
+  **unconfirmed** (the intentional deviation from legacy's auto-confirm),
+  confirming moves the customer's gold debt 8.25 → 7.3836, and confirming again
+  **toggles it back** and restores the balance exactly.
+
+No B2B breakage was found. Three failures in the first drafts were test bugs,
+not product bugs, each corrected after checking the real caller:
+
+| Wrong assumption | What the admin panel actually sends |
+|---|---|
+| `POST cities/list` | `admin/cities/list` (endpoints.ts:152) |
+| `by-ids` takes `ids` | `products_id` (stores/cart.ts:102) |
+| document `type: 2` is cash | `type: 4` is «پولی»; 2 is «حواله» and takes a weight in `value` (addFinDoc.vue:33) |
+
+**Data touched:** both scripts delete only what they create (one order with its
+items/status events/ledger entries; one ledger entry). The write script also
+asserts the customer's gold and rial balances end exactly as they started.