feat(sync): per-order SAVEPOINT protection for order_items upsert

_safe_upsert_order_items(db, order_number, items) wraps the
DELETE + INSERT OR REPLACE pair in SAVEPOINT items. On
IntegrityError / ValueError / TypeError it rolls the savepoint
back, tags the parent order MALFORMED, logs to the error history
file, and returns False to the caller. add_order_items now delegates
to this helper so a single bad payload cannot leave order_items in
a split state.

2 integration tests: happy path + simulated INSERT crash via
aiosqlite monkeypatch. Existing order_items overwrite regression
tests still pass (5/5).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

api/app/services/sqlite_service.py

@@ -774,33 +774,69 @@ def _dedup_items_by_sku(items: list) -> list:
     return order
 
 
+async def _safe_upsert_order_items(db, order_number: str, items: list):
+    """Replace order_items for one order inside a SAVEPOINT.
+
+    On IntegrityError / ValueError / TypeError: rolls back the savepoint,
+    tags the parent order MALFORMED, records the failure in the history
+    log, and returns False. On success returns True.
+
+    Caller is responsible for the outer connection lifecycle.
+    """
+    import sqlite3
+
+    items = _dedup_items_by_sku(items) if items else []
+
+    await db.execute("SAVEPOINT items")
+    try:
+        await db.execute("DELETE FROM order_items WHERE order_number = ?", (order_number,))
+        if items:
+            await db.executemany("""
+                INSERT INTO order_items
+                    (order_number, sku, product_name, quantity, price, baseprice,
+                     vat, mapping_status, codmat, id_articol, cantitate_roa)
+                VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+            """, [
+                (order_number,
+                 item.get("sku"), item.get("product_name"),
+                 item.get("quantity"), item.get("price"), item.get("baseprice"),
+                 item.get("vat"),
+                 item.get("mapping_status"), item.get("codmat"),
+                 item.get("id_articol"), item.get("cantitate_roa"))
+                for item in items
+            ])
+        await db.execute("RELEASE SAVEPOINT items")
+        return True
+    except (sqlite3.IntegrityError, ValueError, TypeError) as err:
+        reason = f"ITEMS_FAIL: {type(err).__name__}: {err}"
+        try:
+            await db.execute("ROLLBACK TO SAVEPOINT items")
+            await db.execute("RELEASE SAVEPOINT items")
+        except sqlite3.OperationalError:
+            # Outer caller will handle reconnect — just log and bail.
+            logger.exception(f"_safe_upsert_order_items: rollback failed for {order_number}")
+            raise
+        # Tag parent order as MALFORMED without removing it from sync state.
+        await db.execute(
+            "UPDATE orders SET status = ?, error_message = ?, updated_at = datetime('now') WHERE order_number = ?",
+            (OrderStatus.MALFORMED.value, reason, order_number),
+        )
+        _log_order_error_history(order_number, reason)
+        return False
+
+
 async def add_order_items(order_number: str, items: list):
     """Replace order items — delete any existing rows, then insert fresh batch.
 
     GoMag is source of truth: re-import must reflect quantity changes.
-    Atomic (DELETE + INSERT in one transaction). Items with the same SKU are
-    merged (quantities summed) to satisfy the (order_number, sku) PK.
+    Wrapped in _safe_upsert_order_items so a bad payload marks the parent
+    order MALFORMED rather than exploding the sync.
     """
     if not items:
         return
-    items = _dedup_items_by_sku(items)
     db = await get_sqlite()
     try:
-        await db.execute("DELETE FROM order_items WHERE order_number = ?", (order_number,))
-        await db.executemany("""
-            INSERT INTO order_items
-                (order_number, sku, product_name, quantity, price, baseprice,
-                 vat, mapping_status, codmat, id_articol, cantitate_roa)
-            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-        """, [
-            (order_number,
-             item.get("sku"), item.get("product_name"),
-             item.get("quantity"), item.get("price"), item.get("baseprice"),
-             item.get("vat"),
-             item.get("mapping_status"), item.get("codmat"),
-             item.get("id_articol"), item.get("cantitate_roa"))
-            for item in items
-        ])
+        await _safe_upsert_order_items(db, order_number, items)
         await db.commit()
     finally:
         await db.close()