Harden Sæby demo registration and department scope (#335)

Complete and secure public customer/driver registration, authoritative limited-backoffice department scope, one-time employee QR login, and pricing concurrency for the Sæby demo.

services/nginx/app/routes/orderBookingRoute.php

@@ -142,7 +142,7 @@ class orderBookingRoute
             $effectiveCustomer = self::resolveEffectiveCustomerNumber();
             $forcedFilters = $object->forceRestrictFilters([
                 ...($has_permission_other && $user !== false ? [
-                    'department' => $user->getGroup()->getDepartments()
+                    'department' => $this->effectiveDepartmentIds($user)
                 ] : []),
                 ...(!$has_permission_other && $effectiveCustomer !== null ? [
                     'customer_number' => [(int)$effectiveCustomer]
@@ -214,7 +214,7 @@ class orderBookingRoute
             if ($requestedDepartmentId !== null) {
                 $departmentIds = [$requestedDepartmentId];
             } elseif ($hasPermissionOther && $user !== false) {
-                $departmentIds = array_map('intval', $user->getGroup()->getDepartments());
+                $departmentIds = $this->effectiveDepartmentIds($user);
                 if ($departmentIds === []) {
                     $response->success([
                         'past' => 0,