feat(c4): lançamento de pedido — catálogo, alçada por linha, POST /orders

- Prisma: Product + RepDiscountLimit + productCategory em OrderItem + migration
- Seed: 28 produtos (5 categorias) + alçadas user-001 (default 10%, bebidas 8%, perecíveis 5%)
- @sar/api-interface: ProductSummarySchema, ProductDetailSchema, ProductSyncRequestSchema, CreateOrderSchema
- API: CatalogModule (GET /catalog, GET /catalog/:id, POST /catalog/sync)
- API: POST /orders — valida alçada por linha/produto (OQ-2), idempotency-key (FR-4.3), desnorm cliente
- Web: NewOrderPage (3 steps: catálogo → desconto/obs → confirmação)
- Web: botão Novo Pedido na ClientDetailPage (desabilitado se financialStatus=blocked)
- Web: rota /pedidos/novo com search param clientId

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/api/src/app/orders/orders.controller.ts

@@ -1,8 +1,10 @@
-import { Controller, Get, Param, ParseUUIDPipe, Query } from '@nestjs/common';
+import { Body, Controller, Get, HttpCode, Param, ParseUUIDPipe, Post, Query } from '@nestjs/common';
 import { ClsService } from 'nestjs-cls';
 import { createZodDto } from 'nestjs-zod';
 import {
+  CreateOrderSchema,
   OrderListQuerySchema,
+  type CreateOrder,
   type OrderDetail,
   type OrderListQuery,
   type OrderListResponse,
@@ -11,6 +13,7 @@ import type { WorkspaceClsStore } from '../workspace/workspace.types';
 import { OrdersService } from './orders.service';
 
 class OrderListQueryDto extends createZodDto(OrderListQuerySchema) {}
+class CreateOrderDto extends createZodDto(CreateOrderSchema) {}
 
 @Controller({ path: 'orders' })
 export class OrdersController {
@@ -25,6 +28,13 @@ export class OrdersController {
     return this.orders.list(parsed, this.cls.get('userId') ?? '', this.cls.get('role') ?? 'rep');
   }
 
+  @Post()
+  @HttpCode(201)
+  create(@Body() body: CreateOrderDto): Promise<OrderDetail> {
+    const parsed = CreateOrderSchema.parse(body) as CreateOrder;
+    return this.orders.create(parsed, this.cls.get('userId') ?? '');
+  }
+
   @Get(':id')
   findOne(@Param('id', ParseUUIDPipe) id: string): Promise<OrderDetail> {
     return this.orders.findOne(id, this.cls.get('userId') ?? '', this.cls.get('role') ?? 'rep');