fix(core): money & inventory integrity hardening — server-authoritative pricing, atomic writes, ledger discipline

[bighadj22]

Summary

A probe-first audit of every money and inventory path in the platform. Each issue was proven red on real D1 (Miniflare + real migrations, no mocks for the flows) before fixing, and each fix is locked by a regression test at the same seam.

Fixed issues

🔴 Storefront pricing & delivery

Issue	Proof	Fix
Client-supplied price forging — a shopper could buy a 50 000 DZD product at 1 DZD; the forged price flowed into price, codAmount, customer totalSpent, driver pendingCash	forged 1 DZD order persisted on real D1	createStoreOrder resolves prices server-side from the catalog (product row / variant rows); order price = true Σ line totals; pricePerUnit is display-only
Silent free shipping — orders to wilayas without a delivery rule (or a disabled delivery type) charged 0 DZD	getDeliveryFee returned 0 for uncovered wilaya	returns null → handler refuses with DELIVERY_NOT_AVAILABLE (422) before creating the customer row

🔴 Orders / stock

Issue	Proof	Fix
Oversell floor — qty 5 with stock 2 silently sold 2, order said 5	ledger logged -2 vs qty-5 line	guarded subselect ledger writes inside the atomic batch → whole order rolls back on insufficient stock
Concurrency race — two orders both read qty=1	ledger logged -2 against 1 unit, inventory 0	guarded inventory >= qty WHERE → exactly one order commits (proven with racing pair)
Delete left gutted orders — order delete failed on company_api_logs/webhook_events FKs after committing partial state	FK failure with customer stats already decremented, phantom restock	explicit cleanup of FK-blocked children + one atomic batch
Cancel-then-delete double-decrement of customer totalSpent	5000 → 3000 instead of 5000	deleteOrder skips the spend rollback for orders whose spend cancel/return already rolled back
Deleting a delivered order left phantom driver cash	pendingCash/totalEarnings/totalDelivered stayed inflated forever	driver credit reversed for unsettled delivered orders; settled ones keep counters (payment history is append-only truth)
Stale codAmount after carrier amount update	carrier 12 600 vs DB 9 600	syncOrderAfterCarrierUpdate recomputes codAmount = price + deliveryFee

🟠 Drivers & stock ledger

Issue	Proof	Fix
Non-atomic driver settlement — fault between insert/link/counters left settled orders + inflated pendingCash, retry blocked by settled guard	fault-injection probe	createDriverPayment = one db.batch (payment + links + counters)
Invisible driver cash drift (no reconciliation existed)	injected drift undetectable	getDriverById reports cashReconciliation (pendingCash vs real unsettled-orders sum); dashboard DriverDetail shows a warning alert when drift ≠ 0 (ar/en/fr)
Catalog inventory edits bypassed the stock ledger	variant 10→15 with zero movement rows	updateProduct/updateVariant log ADJUSTMENT_* movements with true deltas (atomic); createVariant logs opening stock; deleteVariant follows the FK cascade so Σ(movements) stays reconciled
adjustStock race + lying labels	concurrent adjusts lost deltas; ADJUSTMENT_ADD accepted negative delta	sign-coherence validation + guarded atomic batch (movement + inventory + delta >= 0 WHERE)

Errors

• Unknown errors now return "An unexpected error occurred" + requestId in context for log correlation. The [variable]-redaction message soup is gone (that was this bug's original symptom report).

Test plan

• New real-D1 suites: money-integrity-probes (6), orders.delete-e2e (2), orders.stock-lifecycle-e2e (14), flagged-fixes (18) — includes fault-injection atomicity probes and racing-order probes
• cod-server: 117 files / 1705 tests green, tsc --noEmit clean
• cod-client-astro: typecheck clean, 142 tests green (incl. three-locale i18n guard for the new drift-warning keys)
• E2E migration application batched through d1.batch — fixes the Miniflare loopback-port exhaustion that flaked the full suite
• Deployed and smoke-verified on the production Worker before opening this PR

Notes

• Dashboard-facing domain docs (store/CONTEXT.md, stock/CONTEXT.md) updated: Client-Supplied Price → Server-Authoritative Pricing; delivery availability is server-enforced; catalog-edit ledger discipline.
• Known cosmetic follow-up (not money): the storefront rates map still displays fees for disabled delivery types — the server refuses those orders, but the customer sees the fee before rejection. Needs a small theme01 change.