feat: the server checks the grade against the files before approving

The price depends on the grade, which the browser worked out and the API
took on trust. Before a cart is approved at checkout the API now recomputes
it from the uploaded files by the Site's own rules: the pixel size in a
PNG, JPG or WebP header across the printed width (rotation included), and
the area-weighted DPI of the images placed in a PDF of up to 150 MB, 300
for vectors. Sheets take the worst grade, artworks the average. A claim more
than 2 points above the file's grade, or a discount on a file the server
cannot grade, waits for an operator, with the reason on the Kanban.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/smoke_test.py

@@ -175,7 +175,11 @@ def run():
     assert not client.call('/quotes/'+qid)['auto_approved']
     # A cart the Site priced is approved at once and can be paid straight away,
     # at the server's own prices; no operator can then change it.
-    small={**draft,'request_key':str(uuid4()),'items':[item_spec('avulsa','2.75',90,uid)]}
+    # The server works the grade out from the file: this PNG is 6059 px across
+    # 57 cm, 270 DPI, which is grade 90.
+    png=b'\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR'+(6059).to_bytes(4,'big')+(2000).to_bytes(4,'big')+b'\x08\x06\x00\x00\x00'+b'\x00'*4
+    graded=upload_bytes(client,png,name='arte-270dpi.png')
+    small={**draft,'request_key':str(uuid4()),'items':[item_spec('avulsa','2.75',90,graded)]}
     auto=client.call('/quotes',small)
     assert auto['status']=='approved'
     seen=client.call('/quotes/'+auto['id'])
@@ -188,6 +192,12 @@ def run():
     held=client.call('/quotes',{**small,'request_key':str(uuid4()),'items':[claimed]})
     assert held['status']=='pending_review'
     assert client.call('/quotes/'+held['id'])['review_reason']=='Nota informada sem análise da arte'
+    # A better grade than the file supports, or one the server cannot check, waits too.
+    inflated=client.call('/quotes',{**small,'request_key':str(uuid4()),'items':[item_spec('avulsa','2.75',100,graded)]})
+    assert inflated['status']=='pending_review'
+    assert client.call('/quotes/'+inflated['id'])['review_reason']=='Nota 100 maior que a do arquivo (90)'
+    unchecked=client.call('/quotes',{**small,'request_key':str(uuid4()),'items':[item_spec('avulsa','2.75',90,uid)]})
+    assert client.call('/quotes/'+unchecked['id'])['review_reason']=='Nota não conferida no servidor'
     print('PASS: priced carts are approved at checkout; large or inconsistent ones wait for review')
     client.call('/orders/dev-paid',{'quote_id':qid,'total_cents':1},expected=422)
     other.call('/orders/dev-paid',{'quote_id':qid},expected=404)