feat: approve priced carts at checkout so customers can pay at once

Every quote waited for an operator before it could be paid, so an order
placed at night waited for the morning. A cart the Site priced is now
approved when the quote is created, through the same server pricing the
operator's approval uses (app/quote_review.py). Orders above
QUOTE_AUTO_MAX_METRES (50 m) and items claiming a discount on art the Site
could not analyse still wait for review; the Kanban shows which quotes were
approved automatically and why the others wait.

The grade is still computed in the browser (roadmap 3.2, 3.9), so the
discount remains a customer-supplied value until the server computes it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/browser_test.mjs

@@ -97,7 +97,8 @@ try{
   assert.equal(await site.eval('document.getElementById("bPagar").disabled'),false);
   await site.click('#bPagar');
   try{
-    await waitFor(async()=> (await site.text()).includes('Arquivos enviados.'),'browser upload and quote',45000);
+    // A cart the Site can price is approved at once: the customer pays now.
+    await waitFor(async()=> (await site.text()).includes('Total validado no servidor:'),'browser upload and automatic approval',45000);
   }catch(error){
     console.error('Checkout status:',await site.eval('document.getElementById("checkoutStatus")?.textContent'));
     throw error;
@@ -107,16 +108,15 @@ try{
   await kanban.fill('#email',process.env.OPERATOR_EMAIL||'operator@example.test');
   await kanban.fill('#password',process.env.OPERATOR_PASSWORD||'local-operator-only');
   await kanban.eval('document.getElementById("login").requestSubmit()');
-  // Quotes live in their own tab; the review pane shows the one picked.
+  // Quotes live in their own tab; an automatic approval is listed as such.
   await waitFor(()=>kanban.eval('!document.getElementById("app").hidden'),'Kanban sign-in');
-  await kanban.click('[data-tab="quotes"]');
-  await waitFor(()=>kanban.eval(`!!document.querySelector('[data-quote-pick="${qid}"]')`),'quote listed on Kanban');
-  await kanban.click(`[data-quote-pick="${qid}"]`);
-  await waitFor(async()=> (await kanban.text()).includes(qid.slice(0,8)),'quote on Kanban');
   assert.equal(await kanban.eval('sessionStorage.getItem("dtf-operator")'),null);
   assert.equal(await kanban.eval('document.getElementById("password").value'),'');
-  await kanban.eval(`(()=>{const card=[...document.querySelectorAll('.review')].find(x=>x.textContent.includes(${JSON.stringify(qid.slice(0,8))}));card.querySelector('[type=checkbox]').click();card.querySelector('form').requestSubmit();})()`);
-  await waitFor(async()=> (await kanban.text()).includes('Aprovada:'),'quote approval');
+  await kanban.click('[data-tab="quotes"]');
+  await waitFor(()=>kanban.eval('document.querySelectorAll("#quote-filters button").length===2'),'quote filters');
+  await kanban.eval('document.querySelectorAll("#quote-filters button")[1].click()');
+  await waitFor(()=>kanban.eval(`!!document.querySelector('[data-quote-pick="${qid}"]')`),'approved quote listed on Kanban');
+  assert.equal(await kanban.eval(`document.querySelector('[data-quote-pick="${qid}"]').textContent.includes('Aprovada automaticamente')`),true);
   assert.equal(await site.eval('pedido[0].production.sources[0].copies'),1);
   await site.eval('pedido[0].production.sources[0].copies=2;pintaPedido()');
   await waitFor(async()=> (await site.text()).includes('O carrinho mudou'),'same-price production edit invalidates quote');
@@ -188,7 +188,7 @@ try{
   assert.equal(stored,0);
   assert.deepEqual(portal.errors,[]);
   assert.deepEqual(site.errors,[]);assert.deepEqual(kanban.errors,[]);
-  console.log('PASS: browser Site upload → operator quote → local paid order → all main Kanban states → reload persistence. Order '+oid);
+  console.log('PASS: browser Site upload → automatic approval → local paid order → all main Kanban states → reload persistence. Order '+oid);
   console.log('Screenshots: output/local/site.png and output/local/kanban.png');
   console.log('PASS: filename XSS escaping with CSP bypassed, no stored operator password, logout clears browser file blobs.');
 }catch(error){console.error(error);if(stderr)console.error(stderr.slice(-1500));process.exitCode=1;}