feat: Kanban shows each order's artwork, filters quotes and searches orders and quotes

The customer's browser sends the small picture it already makes of each file
(at most 300 KB, WebP/JPEG/PNG read from the bytes, own uploads only); it goes
when the file's bytes go. Board cards, quote rows, the order panel and the
quote detail show it, with the layout drawing as a second view and as the
fallback for files without a picture.

Cotações gets a customer filter (e-mail, CNPJ, WhatsApp) and product, layout
and resolution-warning chips, with the page bar always shown. The board adds
Entrega, Retirada and stalled-order chips. The top search now covers orders in
any stage and unpaid quotes; CNPJ and phone match by digits only when nothing
but digits and punctuation was typed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/LOCAL_SETUP.md

@@ -167,6 +167,14 @@ The workflow test also checks guest-to-account migration, cross-session login,
 revoked sessions, ownership isolation, correction submissions, final revision
 invalidation, secure downloads, and mandatory final-file approval before queueing.
 
+The Kanban's artwork pictures, quote filters and order/quote search have their
+own check, run inside the API container because it writes fixtures to the
+database (and removes them):
+
+```bash
+docker compose -f compose.local.yaml exec -T -e SITE_BASE_URL=http://site -e SITE_HOST_HEADER=localhost api python -m tests.kanban_test
+```
+
 Security and malware regressions are separate so an authorized harmless EICAR
 test is unmistakable: