feat(cf-order): wire session userId + surface DB-only cols in Prisma

Follow-up to the 2026-05-20 schema-drift ALTER. Now that the DB
accepts the create() call, also do the cleanup:

1. PRISMA SCHEMA — added the four DB-only columns that were
   previously raw-SQL only. CfExtract now declares:
     userId         String?                       // Authentik sub of orderer
     type           String?  @default("epay")     // 'epay' | 'admin'
     pdfData        Bytes?                        // legacy inline PDF
     adminOrderedBy String?                       // ops who placed for someone

   Plus two new indices: @@index([userId]) and the composite
   @@index([userId, nrCadastral]) so per-user "my orders" lookups
   don't scan. Prisma client regenerated; type-check clean.

2. SESSION → USER ID PROPAGATION — /api/ancpi/order now reads the
   NextAuth session at request time and stamps the userId onto each
   parcel before enqueue:
     const session = await getAuthSession();
     const userId = session?.user.id ?? session?.user.email;
     const stampedParcels = parcels.map(p => ({ ...p, userId: p.userId ?? userId }));
   Body-supplied userId still wins (admin/cron paths can override).

3. ENQUEUEORDER PATH — CfExtractCreateInput gained an optional
   userId field. epay-queue.ts's tx.cfExtract.create({}) now sets:
     userId: input.userId,    // (undefined → NULL, allowed post-patch)
     type: "epay",            // explicit; DB also has default but
                              // setting it makes the column visible
                              // in Prisma RETURNING reads.

After this commit, new orders carry the orderer's identity. Existing
NULL-userId rows from before this fix stay as-is (DB allows NULL).
Future RLS work on architots_postgres (if it survives Faza H) can
key off this column.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/modules/parcel-sync/services/epay-queue.ts

@@ -138,6 +138,12 @@ export async function enqueueBatch(
           prodId: input.prodId ?? 14200,
           status: "queued",
           version: (agg._max.version ?? 0) + 1,
+          // userId: Authentik sub of the orderer (propagated from
+          // /api/ancpi/order's session). Falls back to undefined for
+          // legacy callers that don't pass it — DB allows NULL after
+          // the 2026-05-20 schema patch.
+          userId: input.userId,
+          type: "epay",
         },
       });
     });

src/modules/parcel-sync/services/epay-types.ts

@@ -95,6 +95,10 @@ export type CfExtractCreateInput = {
   uatName: string;
   gisFeatureId?: string;
   prodId?: number;
+  /** Authentik sub (or any stable session id) of the user placing the
+   * order. Persisted on `CfExtract.userId` so we can audit who ordered
+   * what + scope RLS later. Optional for legacy callers. */
+  userId?: string;
 };
 
 export type OrderMetadata = {