feat(backend): PDF deviz + portal client + SMS + invoice service

- PDF generation with WeasyPrint: deviz and factura templates (A4, branding)
- GET /orders/{id}/pdf/deviz returns PDF with order lines and totals
- Client portal (public, no auth): GET /p/{token}, POST /p/{token}/accept|reject
- SMS service (SMSAPI.ro) - skips in dev when no token configured
- Invoice service: create from validated order, auto-number (F-YYYY-NNNN)
- GET /invoices/{id}/pdf returns factura PDF
- Order status_client field for client accept/reject tracking
- Alembic migration for status_client
- 19 passing tests (auth + sync + orders + pdf + portal + invoices)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/orders/router.py

@@ -1,9 +1,16 @@
 from fastapi import APIRouter, Depends, HTTPException
+from fastapi.responses import Response
+from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from app.db.models.order import Order
+from app.db.models.order_line import OrderLine
+from app.db.models.tenant import Tenant
+from app.db.models.vehicle import Vehicle
 from app.db.session import get_db
 from app.deps import get_tenant_id
 from app.orders import schemas, service
+from app.pdf.service import generate_deviz
 
 router = APIRouter()
 
@@ -81,3 +88,70 @@ async def validate_order(
         return {"status": order.status}
     except ValueError as e:
         raise HTTPException(status_code=422, detail=str(e))
+
+
+@router.get("/{order_id}/pdf/deviz")
+async def get_deviz_pdf(
+    order_id: str,
+    tenant_id: str = Depends(get_tenant_id),
+    db: AsyncSession = Depends(get_db),
+):
+    r = await db.execute(
+        select(Order).where(Order.id == order_id, Order.tenant_id == tenant_id)
+    )
+    order = r.scalar_one_or_none()
+    if not order:
+        raise HTTPException(status_code=404, detail="Order not found")
+
+    r = await db.execute(select(Vehicle).where(Vehicle.id == order.vehicle_id))
+    vehicle = r.scalar_one_or_none()
+
+    r = await db.execute(select(Tenant).where(Tenant.id == tenant_id))
+    tenant = r.scalar_one()
+
+    r = await db.execute(
+        select(OrderLine).where(OrderLine.order_id == order.id)
+    )
+    lines = r.scalars().all()
+
+    order_data = {
+        "id": order.id,
+        "data_comanda": order.data_comanda,
+        "nr_auto": vehicle.nr_inmatriculare if vehicle else "",
+        "client_nume": vehicle.client_nume if vehicle else "",
+        "marca_denumire": "",
+        "model_denumire": "",
+        "total_manopera": order.total_manopera,
+        "total_materiale": order.total_materiale,
+        "total_general": order.total_general,
+    }
+
+    tenant_data = {
+        "nume": tenant.nume,
+        "cui": tenant.cui,
+        "adresa": tenant.adresa,
+        "telefon": tenant.telefon,
+    }
+
+    lines_data = [
+        {
+            "tip": l.tip,
+            "descriere": l.descriere,
+            "ore": l.ore,
+            "pret_ora": l.pret_ora,
+            "cantitate": l.cantitate,
+            "pret_unitar": l.pret_unitar,
+            "um": l.um,
+            "total": l.total,
+        }
+        for l in lines
+    ]
+
+    pdf_bytes = generate_deviz(order_data, lines_data, tenant_data)
+    return Response(
+        content=pdf_bytes,
+        media_type="application/pdf",
+        headers={
+            "Content-Disposition": f'inline; filename="deviz-{order.id[:8]}.pdf"'
+        },
+    )