feat: Minha conta with sign-in, overview, orders and account details

The order page becomes the customer's area, one page at four addresses:

- /conta/entrar: sign in or create an account, side by side. "Esqueci
  minha senha" points to the Dropstar WhatsApp until e-mail can be sent.
- /conta: the counts of orders waiting for payment, in production, in
  correction and finished, and the latest one.
- /conta/pedidos: every order and the cart waiting for payment in one list,
  newest first, filtered by group, order number and period, ten per page.
  The cart shows "Aguardando pagamento" and its "Pagar" goes to the PIX
  page when a PIX code is open. An order opens in place with its progress,
  items, delivery, history, files and the correction form. A guest sees
  the orders paid in this browser.
- /conta/dados: WhatsApp and a saved delivery address (the CNPJ is locked),
  e-mail and password changes, both confirmed with the current password;
  a password change signs the other devices out.

The cart fills in the account's details and saved address. New API routes
for the details, and the order list takes filters and pages and returns
the counts; only the newest unpaid quote whose files still exist is listed.
The Site's "Minha conta" and "Ver meus pedidos" point to the new addresses.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/workflow_test.py

@@ -15,7 +15,23 @@ def run():
     password='local-test-password-'+uuid4().hex
     customer.call('/account/register',{'customer':profile,'password':password})
     assert customer.call('/account/me')['customer']['mail']==profile['mail']
-    assert customer.call('/customer/orders')['orders'][0]['id']==oid
+    assert [e['id'] for e in customer.call('/customer/orders')['items'] if e['kind']=='order'][0]==oid
+    # The list filters, pages and counts by group.
+    listing=customer.call('/customer/orders?status=prod&page=1&size=1')
+    assert listing['counts']['prod']>=1 and listing['total']==listing['counts']['prod'] and len(listing['items'])==1, listing
+    assert customer.call('/customer/orders?status=fin')['items']==[]
+    assert customer.call('/customer/orders?number='+str(order['number']))['items'][0]['id']==oid
+    # The account's details change; the CNPJ does not, and e-mail and password need the password.
+    address={'recipient':'Workflow Ltda','street':'Rua de Teste','number':'10','complement':'',
+             'district':'Centro','city':'Franca','state':'SP','postal_code':'14400000'}
+    saved=customer.call('/account/profile',{'zap':'(16) 98888-7777','address':address})['customer']
+    assert saved['zap']=='16988887777' and saved['cnpj']==profile['cnpj'] and saved['address']['city']=='Franca'
+    assert customer.call('/account/me')['customer']['address']['postal_code']=='14400000'
+    customer.call('/account/profile',{'zap':'16988887777','cnpj':'00000000000000'},expected=422)
+    customer.call('/account/email',{'email':'x-'+profile['mail'],'password':'wrong-password'},expected=401)
+    customer.call('/account/password',{'current':'wrong-password','new':'another-password-123'},expected=401)
+    other.call('/account/profile',{'zap':'16988887777'},expected=401)
+    print('PASS: customer order list filters and pages; account details change, CNPJ does not')
     # Email/CNPJ do not grant ownership; only current guest session is migrated.
     other.call('/customer/orders/'+oid,expected=404)
     other.call('/account/login',{'email':profile['mail'],'password':'wrong-password'},expected=401)
@@ -72,7 +88,7 @@ def run():
     old_cookie=list(other.jar)[0].value
     other.call('/account/logout',{})
     cookie.value=old_cookie;revoked.jar.set_cookie(cookie);revoked.call('/customer/orders',expected=401)
-    other.call('/session');assert other.call('/customer/orders')['orders']==[]
+    other.call('/session');assert other.call('/customer/orders')['items']==[]
     print('PASS: logout revokes server session and signed-out visitors cannot see account orders')
 
 if __name__=='__main__':run()