feat(backend): PDF deviz + portal client + SMS + invoice service

- PDF generation with WeasyPrint: deviz and factura templates (A4, branding)
- GET /orders/{id}/pdf/deviz returns PDF with order lines and totals
- Client portal (public, no auth): GET /p/{token}, POST /p/{token}/accept|reject
- SMS service (SMSAPI.ro) - skips in dev when no token configured
- Invoice service: create from validated order, auto-number (F-YYYY-NNNN)
- GET /invoices/{id}/pdf returns factura PDF
- Order status_client field for client accept/reject tracking
- Alembic migration for status_client
- 19 passing tests (auth + sync + orders + pdf + portal + invoices)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/client_portal/router.py

@@ -0,0 +1,94 @@
+from fastapi import APIRouter, Depends, HTTPException
+from sqlalchemy import select, text
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.db.models.order import Order
+from app.db.models.order_line import OrderLine
+from app.db.models.tenant import Tenant
+from app.db.models.vehicle import Vehicle
+from app.db.session import get_db
+
+router = APIRouter()
+
+
+@router.get("/p/{token}")
+async def get_deviz_public(token: str, db: AsyncSession = Depends(get_db)):
+    r = await db.execute(select(Order).where(Order.token_client == token))
+    order = r.scalar_one_or_none()
+    if not order:
+        raise HTTPException(status_code=404, detail="Deviz not found")
+
+    r = await db.execute(select(Tenant).where(Tenant.id == order.tenant_id))
+    tenant = r.scalar_one()
+
+    r = await db.execute(select(Vehicle).where(Vehicle.id == order.vehicle_id))
+    vehicle = r.scalar_one_or_none()
+
+    r = await db.execute(
+        select(OrderLine).where(OrderLine.order_id == order.id)
+    )
+    lines = r.scalars().all()
+
+    return {
+        "order": {
+            "id": order.id,
+            "status": order.status,
+            "data_comanda": order.data_comanda,
+            "total_manopera": order.total_manopera,
+            "total_materiale": order.total_materiale,
+            "total_general": order.total_general,
+            "nr_auto": vehicle.nr_inmatriculare if vehicle else "",
+            "observatii": order.observatii,
+        },
+        "tenant": {
+            "nume": tenant.nume,
+            "telefon": tenant.telefon,
+        },
+        "lines": [
+            {
+                "tip": l.tip,
+                "descriere": l.descriere,
+                "ore": l.ore,
+                "pret_ora": l.pret_ora,
+                "cantitate": l.cantitate,
+                "pret_unitar": l.pret_unitar,
+                "um": l.um,
+                "total": l.total,
+            }
+            for l in lines
+        ],
+    }
+
+
+@router.post("/p/{token}/accept")
+async def accept_deviz(token: str, db: AsyncSession = Depends(get_db)):
+    r = await db.execute(select(Order).where(Order.token_client == token))
+    order = r.scalar_one_or_none()
+    if not order:
+        raise HTTPException(status_code=404, detail="Deviz not found")
+    await db.execute(
+        text(
+            "UPDATE orders SET status_client='ACCEPTAT', updated_at=datetime('now') "
+            "WHERE token_client=:t"
+        ),
+        {"t": token},
+    )
+    await db.commit()
+    return {"ok": True}
+
+
+@router.post("/p/{token}/reject")
+async def reject_deviz(token: str, db: AsyncSession = Depends(get_db)):
+    r = await db.execute(select(Order).where(Order.token_client == token))
+    order = r.scalar_one_or_none()
+    if not order:
+        raise HTTPException(status_code=404, detail="Deviz not found")
+    await db.execute(
+        text(
+            "UPDATE orders SET status_client='RESPINS', updated_at=datetime('now') "
+            "WHERE token_client=:t"
+        ),
+        {"t": token},
+    )
+    await db.commit()
+    return {"ok": True}