Add quote and order HTTP APIs on manifest documents.

Expose store-backed CRUD for quotes and sales orders with shared ManifestLine shapes, entityId customers, and documented date semantics.

docs/api/routes/order/create.md

@@ -0,0 +1,70 @@
+# `POST /order`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+Create order
+
+Creates a sales order with header and lines in one transaction.
+`date` is the document date (expected delivery).
+`entityId` must be a company customer (not Lieferanten/POS), or null.
+Each line requires `sku`, `amount`, `net`, and `tax` (rate); `rebate` defaults to `0`.
+
+
+## Body (JSON)
+
+```json
+{
+  "number": "O-2026-001",
+  "date": "2026-09-15",
+  "entityId": 1,
+  "lines": [
+    {
+      "sku": "1",
+      "amount": 10,
+      "net": 99.5,
+      "tax": 19
+    }
+  ]
+}
+```
+
+## Response `201`
+
+Created order
+
+```json
+{
+  "order": {
+    "id": 1,
+    "number": "…",
+    "type": "order",
+    "entityId": 1,
+    "date": "2026-08-10T00:00:00.000Z",
+    "lines": [
+      {
+        "id": 1,
+        "articleId": 1,
+        "sku": "…",
+        "amount": 1,
+        "net": 1,
+        "rebate": 1,
+        "tax": 1,
+        "comment": "…"
+      }
+    ]
+  }
+}
+```
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | Invalid order, invalid lines, or no company selected — `{"error":"…"}` |
+| 401 | Unauthorized — `{"error":"…"}` |
+| 403 | Not authorized — `{"error":"…"}` |
+| 404 | Company, entity, or article not found — `{"error":"…"}` |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._