feat: redesign the Kanban and keep test wording out of production

Kanban: tabs for production, quote review and payments/integrations; compact
cards with products, metres, print-file status, delivery and time in stage;
an order panel with stage progress, one main action, a correction reason in
place, items with a preview drawn from the approved layout, final-file
approval and the history as a timeline. Quote review gets a list and a pane;
payment issues resolve in place; integrations show their real state, Tiny's
connection with a read-only "Testar conexão", and a readable send log. The
previous Kanban is kept in git tag ui-v1 and is no longer served.

Production wording: the customer portal no longer says it is a local test
environment outside the local stack; the checkout no longer tells customers
to use the Kanban or shows internal stage codes; sign-in, session, quota and
print-file messages are Portuguese and never say "local". A simulated freight
price is refused outside the local stack until a real freight provider
exists, so production only offers pickup.

The browser suite drives the new tabs and panel and still checks the whole
upload, quote, payment and production journey. Full CI sequence passes locally.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/browser_test.mjs

@@ -92,6 +92,11 @@ try{
   await kanban.fill('#email',process.env.OPERATOR_EMAIL||'operator@example.test');
   await kanban.fill('#password',process.env.OPERATOR_PASSWORD||'local-operator-only');
   await kanban.eval('document.getElementById("login").requestSubmit()');
+  // Quotes live in their own tab; the review pane shows the one picked.
+  await waitFor(()=>kanban.eval('!document.getElementById("app").hidden'),'Kanban sign-in');
+  await kanban.click('[data-tab="quotes"]');
+  await waitFor(()=>kanban.eval(`!!document.querySelector('[data-quote-pick="${qid}"]')`),'quote listed on Kanban');
+  await kanban.click(`[data-quote-pick="${qid}"]`);
   await waitFor(async()=> (await kanban.text()).includes(qid.slice(0,8)),'quote on Kanban');
   assert.equal(await kanban.eval('sessionStorage.getItem("dtf-operator")'),null);
   assert.equal(await kanban.eval('document.getElementById("password").value'),'');
@@ -114,19 +119,23 @@ try{
   const oid=await kanban.eval(`board.orders.find(o=>o.quote_id===${JSON.stringify(qid)}).id`);
   assert.deepEqual(await kanban.eval(`(()=>{const spec=board.orders.find(o=>o.id===${JSON.stringify(oid)}).snapshot.items[0].production;const source=spec.sources[0];return {kind:source.kind,copies:source.copies,length:Number(source.length_cm),height:Number(spec.height_cm),placed:spec.placements.length}})()`),
     {kind:'sheet',copies:1,length:101,height:101,placed:1});
-  // Click real transition buttons, including rerender after each move.
+  // Open the order's panel from its card, then click the real transition
+  // buttons there, including the rerender after each move.
+  await kanban.click('[data-tab="board"]');
+  await kanban.click(`[data-card="${oid}"]`);
+  await waitFor(()=>kanban.eval(`!!document.querySelector('[data-order="${oid}"] [data-move]')`),'order panel');
   for(const [title,state] of [['Arte tratada','tra'],['Fila de impressão','fil'],['Imprimindo','imp'],['Finalizado','fin']]){
     if(state==='fil'){
-      await kanban.eval(`(()=>{const card=document.querySelector('[data-order="${oid}"]');[...card.querySelectorAll('button')].find(x=>x.textContent==='Arquivos de produção').click();})()`);
       await waitFor(()=>kanban.eval(`!!document.querySelector('[data-order="${oid}"] [data-final-item]')`),'final upload controls');
       const doc=await kanban.call('DOM.getDocument');
       const input=await kanban.call('DOM.querySelector',{nodeId:doc.root.nodeId,selector:`[data-order="${oid}"] [data-final-item]`});
       await kanban.call('DOM.setFileInputFiles',{nodeId:input.nodeId,files:[resolve('tests/fixtures/local-test.cdr')]});
       await kanban.fill(`[data-order="${oid}"] input[placeholder="Nota da revisão"]`,'Browser test final file');
-      await kanban.eval(`(()=>{const form=document.querySelector('[data-order="${oid}"] form');form.querySelector('[type=checkbox]').click();form.requestSubmit();})()`);
+      await kanban.eval(`(()=>{const check=document.querySelector('[data-order="${oid}"] [data-confirm]');check.click();check.closest('form').requestSubmit();})()`);
       await waitFor(()=>kanban.eval(`board.orders.find(o=>o.id==='${oid}').version===2`),'final file approval');
     }
-    await kanban.eval(`(()=>{const card=document.querySelector('[data-order="${oid}"]');[...card.querySelectorAll('button')].find(x=>x.textContent===${JSON.stringify('→ '+title)}).click();})()`);
+    await waitFor(()=>kanban.eval(`!!document.querySelector('[data-order="${oid}"] [data-move="${state}"]')`),'move to '+title);
+    await kanban.click(`[data-order="${oid}"] [data-move="${state}"]`);
     await waitFor(()=>kanban.eval(`board.orders.find(o=>o.id==='${oid}').state==='${state}'`),'transition '+state);
   }
   // Reload proves the board is persisted on the backend.

tests/print_file_test.py

@@ -126,7 +126,7 @@ def run():
     manual = upload_bytes(client, b'LOCAL PRINT TEST - NOT AN IMAGE', name='LOCAL-PRINT-TEST.cdr')
     order = paid_order(client, loose_item(manual, copies=1))
     order, row = wait_print(client, order['id'], 'manual')
-    assert 'not an image' in row['detail']['reason'], row
+    assert 'não é uma imagem' in row['detail']['reason'], row
     rows = client.call('/operator/orders/' + order['id'] + '/print-files', {}, operator=True)
     assert rows[0]['status'] == 'pending'
     wait_print(client, order['id'], 'manual')

tests/test_printfile.py

@@ -115,19 +115,19 @@ class PrintFileTests(unittest.TestCase):
 
     def test_refuses_what_it_cannot_reproduce(self):
         png = self.save(quadrants(), 'a.png')
-        with self.assertRaisesRegex(Unsupported, 'proportions'):
+        with self.assertRaisesRegex(Unsupported, 'proporções'):
             self.render(item([placement(0, 0, 20, 20)], [source(20, 20)], 20), [png])
-        with self.assertRaisesRegex(Unsupported, 'billed'):
+        with self.assertRaisesRegex(Unsupported, 'cobrados'):
             self.render(item([placement(0, 0, 20, 10)], [source(20, 10)], 150, billed='1.0'), [png])
         fake_pdf = os.path.join(self.dir.name, 'art.pdf')
         with open(fake_pdf, 'wb') as handle:
             handle.write(b'%PDF-1.4\n%%EOF\n')
-        with self.assertRaisesRegex(Unsupported, 'not a PDF'):
+        with self.assertRaisesRegex(Unsupported, 'não é um PDF'):
             self.render(item([placement(0, 0, 20, 10)], [source(20, 10)], 10), [fake_pdf])
         cdr = os.path.join(self.dir.name, 'art.cdr')
         with open(cdr, 'wb') as handle:
             handle.write(b'not artwork')
-        with self.assertRaisesRegex(Unsupported, 'not an image'):
+        with self.assertRaisesRegex(Unsupported, 'não é uma imagem'):
             self.render(item([placement(0, 0, 20, 10)], [source(20, 10)], 10), [cdr])
 
     def test_long_layouts_scale_user_space_instead_of_splitting(self):
@@ -247,12 +247,12 @@ class PdfSourceTests(unittest.TestCase):
         self.assertEqual(detail['min_dpi'], round(80 / (20 / 2.54)))
 
     def test_refuses_pdfs_it_cannot_place(self):
-        with self.assertRaisesRegex(Unsupported, '2 pages'):
+        with self.assertRaisesRegex(Unsupported, '2 páginas'):
             self.render(item([placement(0, 0, 20, 10)], [source(20, 10)], 10), [self.pdf('two.pdf', pages=2)])
-        with self.assertRaisesRegex(Unsupported, 'password'):
+        with self.assertRaisesRegex(Unsupported, 'senha'):
             self.render(item([placement(0, 0, 20, 10)], [source(20, 10)], 10),
                         [self.pdf('locked.pdf', password='secret')])
-        with self.assertRaisesRegex(Unsupported, 'proportions'):
+        with self.assertRaisesRegex(Unsupported, 'proporções'):
             self.render(item([placement(0, 0, 20, 20)], [source(20, 20)], 20), [self.pdf('square.pdf')])
 
     @unittest.skipIf(fitz is None, 'PyMuPDF is not installed')

tests/test_tiny.py

@@ -43,8 +43,8 @@ class TinyTests(unittest.TestCase):
             self.calls.append((request.method, path))
             assert request.headers['authorization'] == 'Bearer access-1'
             if request.method == 'GET' and path == '/contatos':
-                cnpj = request.url.params['cpfCnpj']
-                return httpx.Response(200, json={'itens': [c for c in self.contacts if c['cpfCnpj'] == cnpj]})
+                cnpj = request.url.params.get('cpfCnpj')
+                return httpx.Response(200, json={'itens': [c for c in self.contacts if cnpj in (None, c['cpfCnpj'])]})
             if request.method == 'POST' and path == '/contatos':
                 contact = {**json.loads(request.content), 'id': 500 + len(self.contacts)}
                 self.contacts.append(contact)
@@ -61,6 +61,7 @@ class TinyTests(unittest.TestCase):
                 return httpx.Response(200, json={'id': order['id'], 'numeroPedido': order['numeroPedido']})
             return httpx.Response(404)
 
+        self.handler = handler
         self.tiny = TinyOrders(auth=FakeAuth(), transport=httpx.MockTransport(handler),
                                today=date(2026, 9, 24))
 
@@ -106,6 +107,14 @@ class TinyTests(unittest.TestCase):
                 self.tiny.deliver('k3', PAID)
         self.assertNotIn(('POST', '/pedidos'), self.calls)
 
+    def test_connection_check_only_reads(self):
+        from app.tiny import check
+        results = check(auth=FakeAuth(), transport=httpx.MockTransport(self.handler))
+        self.assertEqual(results, {'pedidos': 'ok', 'contatos': 'ok'})
+        self.assertTrue(all(method == 'GET' for method, _ in self.calls))
+        denied = check(auth=FakeAuth(), transport=httpx.MockTransport(lambda r: httpx.Response(403, text='forbidden')))
+        self.assertTrue(denied['pedidos'].startswith('GET /pedidos: 403'))
+
     def test_rate_limit_is_a_retryable_failure(self):
         tiny = TinyOrders(auth=FakeAuth(), transport=httpx.MockTransport(lambda r: httpx.Response(429)))
         with self.assertRaisesRegex(TinyError, 'rate limit'):