feat(backend): sync endpoints + all models + seed + order workflow

- All business models: Vehicle, Order, OrderLine, Invoice, Appointment,
  CatalogMarca/Model/Ansamblu/Norma/Pret/TipDeviz/TipMotor, Mecanic
- Sync endpoints: GET /sync/full, GET /sync/changes?since=, POST /sync/push
  with tenant isolation and last-write-wins conflict resolution
- Order CRUD with state machine: DRAFT -> VALIDAT -> FACTURAT
  Auto-recalculates totals (manopera + materiale)
- Vehicle CRUD: list, create, get, update
- Seed data: 24 marci, 11 ansamble, 6 tipuri deviz, 5 tipuri motoare, 3 preturi
- Alembic migration for all business models
- 13 passing tests (auth + sync + orders)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/tests/test_sync.py

@@ -0,0 +1,128 @@
+import uuid
+from datetime import UTC, datetime
+
+import pytest
+from httpx import ASGITransport, AsyncClient
+
+from app.main import app
+
+
+@pytest.mark.asyncio
+async def test_full_sync_returns_all_tables(client, auth_headers):
+    r = await client.get("/api/sync/full", headers=auth_headers)
+    assert r.status_code == 200
+    data = r.json()
+    assert "tables" in data and "synced_at" in data
+    assert "vehicles" in data["tables"]
+    assert "catalog_marci" in data["tables"]
+    assert "orders" in data["tables"]
+    assert "mecanici" in data["tables"]
+
+
+@pytest.mark.asyncio
+async def test_sync_push_insert_vehicle(client, auth_headers):
+    # Get tenant_id from /me
+    me = await client.get("/api/auth/me", headers=auth_headers)
+    tenant_id = me.json()["tenant_id"]
+
+    vid = str(uuid.uuid4())
+    now = datetime.now(UTC).isoformat()
+    r = await client.post(
+        "/api/sync/push",
+        headers=auth_headers,
+        json={
+            "operations": [
+                {
+                    "table": "vehicles",
+                    "id": vid,
+                    "operation": "INSERT",
+                    "data": {
+                        "id": vid,
+                        "tenant_id": tenant_id,
+                        "nr_inmatriculare": "CTA01ABC",
+                        "client_nume": "Popescu",
+                        "created_at": now,
+                        "updated_at": now,
+                    },
+                    "timestamp": now,
+                }
+            ]
+        },
+    )
+    assert r.status_code == 200
+    assert r.json()["applied"] == 1
+
+    # Verify via full sync
+    full = await client.get("/api/sync/full", headers=auth_headers)
+    vehicles = full.json()["tables"]["vehicles"]
+    assert len(vehicles) == 1
+    assert vehicles[0]["nr_inmatriculare"] == "CTA01ABC"
+
+
+@pytest.mark.asyncio
+async def test_sync_changes_since(client, auth_headers):
+    me = await client.get("/api/auth/me", headers=auth_headers)
+    tenant_id = me.json()["tenant_id"]
+
+    before = datetime.now(UTC).isoformat()
+
+    vid = str(uuid.uuid4())
+    now = datetime.now(UTC).isoformat()
+    await client.post(
+        "/api/sync/push",
+        headers=auth_headers,
+        json={
+            "operations": [
+                {
+                    "table": "vehicles",
+                    "id": vid,
+                    "operation": "INSERT",
+                    "data": {
+                        "id": vid,
+                        "tenant_id": tenant_id,
+                        "nr_inmatriculare": "B99XYZ",
+                        "created_at": now,
+                        "updated_at": now,
+                    },
+                    "timestamp": now,
+                }
+            ]
+        },
+    )
+
+    r = await client.get(
+        f"/api/sync/changes?since={before}", headers=auth_headers
+    )
+    assert r.status_code == 200
+    data = r.json()
+    assert "vehicles" in data["tables"]
+
+
+@pytest.mark.asyncio
+async def test_sync_push_rejects_wrong_tenant(client, auth_headers):
+    now = datetime.now(UTC).isoformat()
+    vid = str(uuid.uuid4())
+    r = await client.post(
+        "/api/sync/push",
+        headers=auth_headers,
+        json={
+            "operations": [
+                {
+                    "table": "vehicles",
+                    "id": vid,
+                    "operation": "INSERT",
+                    "data": {
+                        "id": vid,
+                        "tenant_id": "wrong-tenant-id",
+                        "nr_inmatriculare": "HACK",
+                        "created_at": now,
+                        "updated_at": now,
+                    },
+                    "timestamp": now,
+                }
+            ]
+        },
+    )
+    assert r.status_code == 200
+    # Wrong tenant_id is rejected (skipped)
+    assert r.json()["applied"] == 0