feat(orders): «عدم سفارش» blocks app orders; import starts everyone allowed (MON-05)

Legacy stored customers.sts but no code read it, so the switch never
stopped an order, and 313 active customers carry it, mostly as the
sign-up default. Owner option 2: enforce it from now on, for orders
placed from the app only (an operator can still order for the
customer), and import every customer as allowed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/api/src/modules/orders/orders.service.spec.ts

@@ -48,3 +48,37 @@ describe('OrdersService.createOrder — sales expert credit', () => {
     expect(created[0].salesAgentId).toBeNull();
   });
 });
+
+/** MON-05 (owner ruling 2026-10-08): «عدم سفارش» stops app orders only. */
+describe('OrdersService.createOrder — order ban', () => {
+  function build(canPlaceOrders: boolean) {
+    const tx = { order: { create: jest.fn(async ({ data }: { data: object }) => ({ id: 'o1', ...data })) } };
+    const prisma = {
+      customer: {
+        findUnique: jest.fn(async () => ({
+          id: 'c1',
+          canPlaceOrders,
+          referredByAgentId: null,
+          goldDebtGrams: new Prisma.Decimal(0),
+          goldCreditLimitGrams: new Prisma.Decimal(1000),
+        })),
+      },
+      $transaction: jest.fn(async (fn: (t: typeof tx) => unknown) => fn(tx)),
+    };
+    const catalog = { getVariantOrThrow: jest.fn(async () => ({ id: 'v1', rashWeightGrams: '10' })) };
+    return new OrdersService(prisma as never, catalog as never, {} as never, { orderStatusReached: jest.fn() } as never);
+  }
+  const dto = { items: [{ productVariantId: 'v1', quantity: 1, wagePercent: 3 }] } as never;
+
+  it('refuses a suspended customer ordering from the app', async () => {
+    await expect(build(false).createOrder(dto, 'c1', { placedBy: 'customer' })).rejects.toThrow('غیرفعال');
+  });
+
+  it('lets an operator place an order for a suspended customer', async () => {
+    await expect(build(false).createOrder(dto, 'c1', { placedBy: 'operator' })).resolves.toMatchObject({ id: 'o1' });
+  });
+
+  it('lets an allowed customer order from the app', async () => {
+    await expect(build(true).createOrder(dto, 'c1', { placedBy: 'customer' })).resolves.toMatchObject({ id: 'o1' });
+  });
+});