feat: approve priced carts at checkout so customers can pay at once

Every quote waited for an operator before it could be paid, so an order
placed at night waited for the morning. A cart the Site priced is now
approved when the quote is created, through the same server pricing the
operator's approval uses (app/quote_review.py). Orders above
QUOTE_AUTO_MAX_METRES (50 m) and items claiming a discount on art the Site
could not analyse still wait for review; the Kanban shows which quotes were
approved automatically and why the others wait.

The grade is still computed in the browser (roadmap 3.2, 3.9), so the
discount remains a customer-supplied value until the server computes it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/api/operator.py

@@ -8,17 +8,16 @@ from uuid import UUID
 
 from fastapi import APIRouter, Depends, HTTPException, Query, Request, Response
 from fastapi.responses import RedirectResponse
-from psycopg.types.json import Jsonb
 
 from ..core import db
 from ..core.auth import (COOKIE_SECURE, DUMMY_PASSWORD_HASH, audit, client_ip, operator,
                     login_failed, password_matches, throttle)
 from ..core.models import Move, OperatorLogin, Resolution, Review
-from ..core.pricing import price
 from ..printjobs import queue as queue_print_files
+from .. import quote_review
 from .. import tiny
 from ..runtime import (BACK, BOARD_FINISHED_LIMIT, BOARD_QUOTE_LIMIT, ENVIRONMENT, STATES, TRANSITIONS, payment,
-                       enqueue, freight, quote_view, storage, upload_row)
+                       enqueue, quote_view, storage)
 from ..scanning import require_clean
 
 router = APIRouter()
@@ -197,31 +196,7 @@ def approve(uid: UUID, body: Review, user=Depends(operator)):
         row = c.execute('SELECT * FROM dtf_local.quotes WHERE id=%s FOR UPDATE', (uid,)).fetchone()
         if not row:
             raise HTTPException(404, 'Quote not found')
-        if row['approved']:
-            raise HTTPException(409, 'Approved quotes are immutable; request a new quote')
-        draft = row['draft']
-        if any(item.get('production', {}).get('version') != 2 for item in draft['items']):
-            raise HTTPException(409, 'Quote uses an obsolete production layout; customer must request a new quote')
-        if len(body.items) != len(draft['items']):
-            raise HTTPException(422, 'Review must cover every item')
-        items = []
-        for item, original in zip(body.items, draft['items']):
-            if item.mode != original['mode'] or list(map(str,item.uploads)) != original['uploads']:
-                raise HTTPException(422, 'Product mode and attached files cannot change during review')
-            if item.production.model_dump(mode='json') != original['production'] or item.quality_status != original['quality_status'] or item.quality_acknowledged != original['quality_acknowledged']:
-                raise HTTPException(422, 'Production instructions and customer acknowledgement cannot change during commercial review')
-            for upload_id in item.uploads:
-                require_clean(upload_row(c, upload_id, row['owner']))
-            items.append({**price(item.mode, str(item.metres), item.grade),
-                          'uploads': original['uploads'], 'production': original['production'],
-                          'quality_status': original['quality_status'],
-                          'quality_acknowledged': original['quality_acknowledged']})
-        quoted_freight = freight.quote(**draft['freight'])
-        approved = {'customer': draft['customer'], 'items': items, 'freight': quoted_freight,
-                    'destination': draft.get('destination'),
-                    'total_cents': sum(i['total_cents'] for i in items)+quoted_freight['total_cents']}
-        c.execute('UPDATE dtf_local.quotes SET approved=%s, reviewed_by=%s, approved_at=now() WHERE id=%s', (Jsonb(approved),user,uid))
-    return approved
+        return quote_review.approve(c, row, body.items, user)
 
 @router.post('/api/operator/orders/{uid}/move')
 def move(uid: UUID, body: Move, user=Depends(operator)):