Delivery API: use externalNumber for user reference

Delivery create now accepts externalNumber (user-supplied reference) instead
of number; the manifest number is auto-allocated server-side via
nextNumber('delivery'). Update patches externalNumber (clearable) rather than
number. DeliverySummary schema documents externalNumber and notes number is
auto-generated. Regenerate API docs.

src/api/openapi.js

@@ -247,6 +247,7 @@
  *           type: integer
  *         number:
  *           type: string
+ *           description: Auto-allocated via nextNumber('delivery')
  *         type:
  *           type: string
  *           enum: [delivery]
@@ -254,6 +255,10 @@
  *           type: integer
  *           nullable: true
  *           description: manifest.entity_id
+ *         externalNumber:
+ *           type: string
+ *           nullable: true
+ *           description: User-supplied reference number
  *         date:
  *           type: string
  *           format: date-time

src/api/routes/delivery.js

@@ -79,8 +79,11 @@ export function register(app, basePath = '') {
      *     summary: Create delivery
      *     description: |
      *       Creates a goods receipt with header and lines in one transaction.
-     *       Each line requires `sku`, `amount`, `net`, and `tax` (rate).
-     *       `rebate` defaults to `0`; `transactedAmount` defaults to `amount`.
+     *       The manifest `number` is allocated automatically via
+     *       `nextNumber('delivery')`; the user-supplied reference is stored as
+     *       `externalNumber`. Each line requires `sku`, `amount`, `net`, and
+     *       `tax` (rate). `rebate` defaults to `0`; `transactedAmount` defaults
+     *       to `amount`.
      *     security:
      *       - cookieAuth: []
      *     x-markdown: delivery/create.md
@@ -90,10 +93,11 @@ export function register(app, basePath = '') {
      *         application/json:
      *           schema:
      *             type: object
-     *             required: [number, date, lines]
+     *             required: [externalNumber, date, lines]
      *             properties:
-     *               number:
+     *               externalNumber:
      *                 type: string
+     *                 description: User-supplied reference number
      *               date:
      *                 type: string
      *                 format: date-time
@@ -105,7 +109,7 @@ export function register(app, basePath = '') {
      *                 items:
      *                   $ref: '#/components/schemas/DeliveryLineInput'
      *             example:
-     *               number: DHL-123
+     *               externalNumber: DHL-123
      *               date: '2026-08-10'
      *               supplierId: 1
      *               lines:
@@ -170,11 +174,11 @@ export function register(app, basePath = '') {
             return res.status(400).json({ error: selected.error });
         }
 
-        const { number, date, supplierId, lines } = req.body ?? {};
+        const { externalNumber, date, supplierId, lines } = req.body ?? {};
 
         try {
             const delivery = await db.create(req.user.id, {
-                number,
+                externalNumber,
                 date,
                 supplierId,
                 lines,
@@ -241,8 +245,10 @@ export function register(app, basePath = '') {
      *     tags: [Delivery]
      *     summary: Update delivery
      *     description: |
-     *       Patches header fields that are present. If `lines` is present, replaces
-     *       all lines; if omitted, leaves lines unchanged. Returns the full delivery.
+     *       Patches header fields that are present. The manifest `number` is
+     *       auto-allocated and cannot be patched; only the user-supplied
+     *       `externalNumber` reference is editable. If `lines` is present,
+     *       replaces all lines; if omitted, leaves lines unchanged.
      *     security:
      *       - cookieAuth: []
      *     x-markdown: delivery/update.md
@@ -259,8 +265,10 @@ export function register(app, basePath = '') {
      *           schema:
      *             type: object
      *             properties:
-     *               number:
+     *               externalNumber:
      *                 type: string
+     *                 nullable: true
+     *                 description: User-supplied reference number (empty/null clears it)
      *               date:
      *                 type: string
      *                 format: date-time
@@ -272,7 +280,7 @@ export function register(app, basePath = '') {
      *                 items:
      *                   $ref: '#/components/schemas/DeliveryLineInput'
      *             example:
-     *               number: DHL-124
+     *               externalNumber: DHL-124
      *               lines: []
      *     responses:
      *       200:
@@ -384,8 +392,8 @@ export function register(app, basePath = '') {
 
         const body = req.body ?? {};
         const patch = {};
-        if (Object.prototype.hasOwnProperty.call(body, 'number')) {
-            patch.number = body.number;
+        if (Object.prototype.hasOwnProperty.call(body, 'externalNumber')) {
+            patch.externalNumber = body.externalNumber;
         }
         if (Object.prototype.hasOwnProperty.call(body, 'date')) {
             patch.date = body.date;