Harden Sæby demo registration and department scope (#335)

Complete and secure public customer/driver registration, authoritative limited-backoffice department scope, one-time employee QR login, and pricing concurrency for the Sæby demo.

services/nginx/app/routes/ordersRoute.php

@@ -111,11 +111,14 @@ class ordersRoute
             // Build department filter when listing as department/admin
             $department_ids = [];
             if ($has_permission_other) {
-                $department_ids = $user->getGroup()->getDepartments();
+                $department_ids = $this->effectiveDepartmentIds($user);
             }
             if (self::isParametersSet(['show_wash_subscription'])) {
                 if (self::getParameter('show_wash_subscription') === 'true') {
-                    $department_ids[] = '10';
+                    $managedScope = $this->limitedBackofficeDepartmentScope($user);
+                    if ($managedScope === null || in_array(10, $department_ids, true)) {
+                        $department_ids[] = 10;
+                    }
                 }
             }
 
@@ -418,6 +421,10 @@ class ordersRoute
                 if (!$order->exists()) {
                     $response->error('Order not found', 400);
                 }
+                $this->requireLimitedBackofficeDepartmentAccess(
+                    $user,
+                    (int)$order->department_id->value()
+                );
                 // Permissions (subuser-aware)
                 $permission_own = self::definePermission('list_own_order_attachments', subusers_permission_node_key::ORDERS_LIST);
                 $permission_other = self::definePermission('list_order_attachments');
@@ -2019,6 +2026,10 @@ class ordersRoute
         if (!$order->exists()) {
             $response->error('Order not found', 404);
         }
+        $this->requireLimitedBackofficeDepartmentAccess(
+            $user,
+            (int)$order->department_id->value()
+        );
         if (!$hasPermissionOther) {
             $effectiveCustomer = self::resolveEffectiveCustomerNumber();
             if ($effectiveCustomer === null || (int)$order->customer_id->value() !== (int)$effectiveCustomer) {