feat: Kanban shows each order's artwork, filters quotes and searches orders and quotes

The customer's browser sends the small picture it already makes of each file
(at most 300 KB, WebP/JPEG/PNG read from the bytes, own uploads only); it goes
when the file's bytes go. Board cards, quote rows, the order panel and the
quote detail show it, with the layout drawing as a second view and as the
fallback for files without a picture.

Cotações gets a customer filter (e-mail, CNPJ, WhatsApp) and product, layout
and resolution-warning chips, with the page bar always shown. The board adds
Entrega, Retirada and stalled-order chips. The top search now covers orders in
any stage and unpaid quotes; CNPJ and phone match by digits only when nothing
but digits and punctuation was typed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/app.py

@@ -37,7 +37,8 @@ async def safe_headers(request, call_next):
     response = await call_next(request)
     if response.status_code in (401,403,429) or response.status_code>=500:
         audit('http_security_event', method=request.method, status=response.status_code, ip=client_ip(request))
-    response.headers['Cache-Control'] = 'no-store'
+    # Nothing is cached unless a route says so (the Kanban's artwork pictures).
+    response.headers.setdefault('Cache-Control', 'no-store')
     response.headers['X-Content-Type-Options'] = 'nosniff'
     response.headers['Referrer-Policy'] = 'no-referrer'
     return response