feat(T5): editor web mapare operatii (hibrid + fuzzy + on-demand needs_mapping)

T5 reinterpretat: nu import DBF, ci editor web al maparii operatie ROAAUTO ->
cod RAR, cu fuzzy lookup si validare de catre utilizator.

- Contract hibrid: item prestatie accepta cod_prestatie (RAR direct, back-compat)
  SAU cod_op_service+denumire (mapat de gateway prin operations_mapping).
- Ingestie: op intern necunoscut -> submission needs_mapping (nu pleaca la RAR);
  codul rezolvat se scrie inapoi in payload_json -> payload builder + worker neatinse.
- Editor HTMX (_mapari.html + GET /_fragments/mapari, POST /mapari): listeaza
  op-urile nemapate, fuzzy preselecteaza codul RAR, save -> re-rezolvare automata
  (queued / needs_data).
- Fuzzy: rapidfuzz.token_sort_ratio pe denumire normalizata (fara diacritice).
- Nomenclator: seed fallback 18 coduri la boot (offline) + refresh live din worker.
- Cont default id=1 cat timp auth API-key (CORE) nu exista (account_id NULL).
- Endpointuri API: GET /v1/mapari/pending, POST /v1/mapari (respinge cod inexistent).
- 15 teste noi (tests/test_mapping.py); 69 pass total.
- Contract actualizat (docs/api-rar-contract.md), rapidfuzz==3.14.5 in requirements.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/worker/__main__.py

@@ -30,6 +30,7 @@ import httpx
 
 from ..config import Settings, get_settings, load_test_credentials
 from ..db import get_connection, init_db, write_heartbeat
+from ..mapping import upsert_nomenclator
 from ..payload import build_rar_payload
 from ..reconcile import match_finalizata
 from ..rar_client import RarAuthError, RarClient, RarError
@@ -202,6 +203,16 @@ def _queue_depth(conn) -> int:
     return int(row["n"]) if row else 0
 
 
+def _refresh_nomenclator(conn, rar: RarClient, token: str) -> None:
+    """Ia nomenclatorul live din RAR si il upsert-eaza local. Erorile NU opresc worker-ul."""
+    try:
+        items = rar.get_nomenclator(token)
+        n = upsert_nomenclator(conn, items)
+        print(f"[worker] nomenclator refresh: {n} coduri", flush=True)
+    except Exception as exc:  # noqa: BLE001 — refresh best-effort, nu blocheaza trimiterea
+        print(f"[worker] nomenclator refresh esuat (continui): {exc}", flush=True)
+
+
 def run() -> int:
     signal.signal(signal.SIGTERM, _stop)
     signal.signal(signal.SIGINT, _stop)
@@ -231,6 +242,9 @@ def run() -> int:
                 rar = RarClient(settings)
                 token = rar.login(creds["email"], creds["password"])
                 write_heartbeat(conn, rar_login_ok=True, detail="login RAR ok")
+                # Refresh nomenclator live (autoritativ) la fiecare login proaspat —
+                # alimenteaza fuzzy lookup-ul din editorul de mapari.
+                _refresh_nomenclator(conn, rar, token)
 
             recover_orphans(conn, settings, rar, token)