Add quote and order HTTP APIs on manifest documents.

Expose store-backed CRUD for quotes and sales orders with shared ManifestLine shapes, entityId customers, and documented date semantics.

docs/api/routes/order/update.md

@@ -0,0 +1,66 @@
+# `PATCH /order/{id}`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+Update order
+
+Patches header fields that are present. If `lines` is present, replaces
+all lines; if omitted, leaves lines unchanged. Returns the full order.
+`date` is the document date (expected delivery).
+
+
+## Path parameters
+
+| Param | Required | Type | Description |
+|-------|----------|------|-------------|
+| `id` | yes | integer |  |
+
+## Body (JSON)
+
+```json
+{
+  "number": "O-2026-001b",
+  "lines": []
+}
+```
+
+## Response `200`
+
+Updated order
+
+```json
+{
+  "order": {
+    "id": 1,
+    "number": "…",
+    "type": "order",
+    "entityId": 1,
+    "date": "2026-08-10T00:00:00.000Z",
+    "lines": [
+      {
+        "id": 1,
+        "articleId": 1,
+        "sku": "…",
+        "amount": 1,
+        "net": 1,
+        "rebate": 1,
+        "tax": 1,
+        "comment": "…"
+      }
+    ]
+  }
+}
+```
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | Invalid order, invalid lines, invalid id, or no company selected — `{"error":"…"}` |
+| 401 | Unauthorized — `{"error":"…"}` |
+| 403 | Not authorized — `{"error":"…"}` |
+| 404 | Order, entity, article, or company not found — `{"error":"…"}` |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._