fix(sync): guard against mass DELETED_IN_ROA when ROA is recovering

After a power loss + reboot, COMENZI was queryable but not yet recovered;
phase 4b-3 read it as empty and sticky-marked 3794 live orders DELETED_IN_ROA
(nulling id_comanda). check_orders_exist also swallowed Oracle errors and
returned a partial set, which callers misread as deletions.

- check_orders_exist now re-raises on Oracle error instead of returning partial
- new invoice_service.deletions_or_guard() raises MassDeletionGuard when the
  would-delete fraction is implausibly high (>30% of >=25 imported orders)
- both deletion sites (auto sync + manual refresh) skip + log on guard trip

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

api/app/services/sync_service.py

@@ -1081,10 +1081,15 @@ async def run_sync(id_pol: int = None, id_sectie: int = None, run_id: str = None
                     existing_ids = await asyncio.to_thread(
                         invoice_service.check_orders_exist, id_comanda_list
                     )
-                    for o in all_imported:
-                        if o["id_comanda"] not in existing_ids:
-                            await sqlite_service.mark_order_deleted_in_roa(o["order_number"])
-                            orders_deleted += 1
+                    try:
+                        to_delete = invoice_service.deletions_or_guard(all_imported, existing_ids)
+                    except invoice_service.MassDeletionGuard as g:
+                        _log_line(run_id, f"⚠ Protectie stergeri: {g}")
+                        await _record_phase_err(run_id, "mass_deletion_guard", g)
+                        to_delete = []
+                    for o in to_delete:
+                        await sqlite_service.mark_order_deleted_in_roa(o["order_number"])
+                        orders_deleted += 1
 
                 if invoices_updated:
                     _log_line(run_id, f"Facturi noi: {invoices_updated} comenzi facturate")