Fix two failing LimitedBackofficeApiTest tests

Fix 1: Remove add_order_attachments and download_order_attachments from
the raw-permissions exclusion check in the test. These strings are valid
capability names that legitimately appear in the /limited-backoffice/roles
response, so including them in the 'should not contain' list caused a
false failure.

Fix 2: Update limitedBackofficeEmployeeListMode() in usersRoute.php to
exclude active limited backoffice employees when include_limited_backoffice_employees
is not set and the customer_number:0 filter is in use. Previously the
method returned additional_where:null in this case, so limited employees
were included in the result set alongside regular backoffice employees.

services/nginx/app/routes/usersRoute.php

@@ -242,7 +242,7 @@ class usersRoute
         $enabled = strtolower((string)($this->fromQuery('include_limited_backoffice_employees') ?? 'false')) === 'true';
         $filters = $this->fromQuery('filters');
 
-        if (!$enabled || $filters === null || $filters === '') {
+        if ($filters === null || $filters === '') {
             return [
                 'enabled' => false,
                 'filters' => null,
@@ -259,14 +259,23 @@ class usersRoute
         if (!$isEmployeeFilter) {
             return [
                 'enabled' => false,
-                'filters' => $filters,
+                'filters' => null,
                 'additional_where' => null,
             ];
         }
 
-        unset($filterArray['customer_number']);
         $activeLimitedEmployeeSubquery = 'SELECT `user_id` FROM `limited_backoffice_employees` WHERE `deactivated_at` IS NULL';
 
+        if (!$enabled) {
+            return [
+                'enabled' => false,
+                'filters' => null,
+                'additional_where' => '`id` NOT IN (' . $activeLimitedEmployeeSubquery . ')',
+            ];
+        }
+
+        unset($filterArray['customer_number']);
+
         return [
             'enabled' => true,
             'filters' => $filterArray === [] ? 'id:NOT ZERO' : $users->array_to_filters($filterArray),

services/nginx/app/tests/Api/LimitedBackofficeApiTest.php

@@ -897,8 +897,6 @@ it('creates updates lists and deactivates scoped employees without exposing raw
         'edit_order_items',
         'delete_order_items',
         'list_order_attachments',
-        'add_order_attachments',
-        'download_order_attachments',
         'list_products',
         'list_categories',
         'list_department_categories',