chore: commit pending admin-panel, api auth and parity doc changes

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>

apps/api/src/modules/admin-orders/admin-orders.controller.ts

@@ -2,7 +2,7 @@ import { Body, Controller, Get, HttpCode, Param, Post } from '@nestjs/common';
 import { AdminOrdersService } from './admin-orders.service';
 import { TableQueryDto } from '../admin-table/table-query.dto';
 import { UpdateOrderStatusDto } from './update-status.dto';
-import { CurrentAdmin, RequirePermission } from '../auth/guards';
+import { CurrentAdmin, RequirePermission, SuperAdminOnly } from '../auth/guards';
 import type { AuthenticatedAdmin } from '../auth/jwt.strategy';
 
 /**
@@ -20,6 +20,7 @@ export class AdminOrdersController {
   /** Legacy POST single-order. POST, not GET, because XTable posts its filters. */
   @Post('list')
   @HttpCode(200)
+  @SuperAdminOnly({ allowBranch: true })
   @RequirePermission('order.list')
   list(@Body() query: TableQueryDto, @CurrentAdmin() admin: AuthenticatedAdmin) {
     /**
@@ -66,6 +67,7 @@ export class AdminOrdersController {
   /** Legacy POST /order from the admin order builder (views/order/create.vue). */
   @Post('create')
   @HttpCode(200)
+  @SuperAdminOnly({ allowBranch: true })
   @RequirePermission('order.create')
   createFromAdmin(
     @Body()
@@ -82,13 +84,17 @@ export class AdminOrdersController {
 
   /** Legacy GET order/type. */
   @Get('type-options')
+  @SuperAdminOnly()
   @RequirePermission('order.create')
   typeOptions() {
     return this.orders.typeOptions();
   }
 
+  // The three routes below also serve the wholesale and sourcing lists, whose
+  // staff hold order.omde / order.tamin rather than the super-admin-only
+  // order.list.
   @Get('status-options')
-  @RequirePermission('order.list')
+  @RequirePermission('order.list', 'order.omde', 'order.tamin')
   statusOptions() {
     return this.orders.statusOptions();
   }
@@ -96,13 +102,13 @@ export class AdminOrdersController {
   /** Legacy POST single/order-sts/edit. */
   @Post('status')
   @HttpCode(200)
-  @RequirePermission('order.list')
+  @RequirePermission('order.list', 'order.omde', 'order.tamin')
   setStatus(@Body() dto: UpdateOrderStatusDto, @CurrentAdmin() admin: AuthenticatedAdmin) {
     return this.orders.setStatus(dto, admin.id);
   }
 
   @Get(':id')
-  @RequirePermission('order.list')
+  @RequirePermission('order.list', 'order.omde', 'order.tamin')
   findOne(@Param('id') id: string) {
     return this.orders.findOne(id);
   }