revert: restore production to the state before 730d0bd (PM/RBAC work moved to 'pm')

Their three commits (730d0bd, 5a9b543, 387edfb) reached production by push and
auto-deployed. 387edfb expects a users.username column that the live database does
not have, so POST /api/v1/auth/login was returning HTTP 500. Their schema changes
never applied either (projects still has only id, name, description, start_date,
pm_user_id, created_at), so nothing depends on the reverted code.

This commit sets the tree back to exactly a02b3ea — verified with git diff against
it — while keeping history linear: the work itself is preserved on 'pm' at 387edfb.

backend/app/routers/quotes.py

@@ -8,7 +8,6 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import exists, func, or_, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_role
 from app.db.engine import get_db
 from app.models.catalog import Material
 from app.models.procurement import (
@@ -43,9 +42,6 @@ from app.utils.security import get_actor
 
 router = APIRouter(prefix="/quotes", tags=["quotes"])
 
-# عملیات نوشتنی تدارکات — فقط ادمین و مدیر تدارکات (مدیر پروژه فقط خواندن دارد)
-_procurement_writer = require_role("admin", "procurement_manager")
-
 
 # --- list filter helpers ---------------------------------------------------
 
@@ -160,12 +156,7 @@ async def get_quote(quote_id, expand: str | None = None, db: AsyncSession = Depe
 # ---------------------------------------------------------------------------
 
 @router.post("", status_code=201)
-async def create_quote(
-    payload: QuoteCreate,
-    db: AsyncSession = Depends(get_db),
-    actor: str = Depends(get_actor),
-    _auth=Depends(_procurement_writer),
-):
+async def create_quote(payload: QuoteCreate, db: AsyncSession = Depends(get_db), actor: str = Depends(get_actor)):
     quote = await quote_service.create_quote(db, payload, actor)
     return {"data": await serialize_quote_with_children(db, quote)}
 
@@ -176,11 +167,7 @@ async def create_quote(
 
 @router.patch("/{quote_id}")
 async def update_quote(
-    quote_id,
-    payload: QuoteUpdate,
-    db: AsyncSession = Depends(get_db),
-    actor: str = Depends(get_actor),
-    _auth=Depends(_procurement_writer),
+    quote_id, payload: QuoteUpdate, db: AsyncSession = Depends(get_db), actor: str = Depends(get_actor)
 ):
     quote = await quote_service.update_quote(db, quote_id, payload, actor)
     return {"data": await serialize_quote(db, quote, set())}
@@ -188,11 +175,7 @@ async def update_quote(
 
 @router.patch("/{quote_id}/children")
 async def replace_quote_children(
-    quote_id,
-    payload: QuoteChildrenReplaceIn,
-    db: AsyncSession = Depends(get_db),
-    actor: str = Depends(get_actor),
-    _auth=Depends(_procurement_writer),
+    quote_id, payload: QuoteChildrenReplaceIn, db: AsyncSession = Depends(get_db), actor: str = Depends(get_actor)
 ):
     """Full replacement of a quote's line items + termsheets (edit modal)."""
     quote = await quote_service.replace_quote_children(db, quote_id, payload, actor)
@@ -205,11 +188,7 @@ async def replace_quote_children(
 
 @router.patch("/{quote_id}/accept")
 async def accept_quote(
-    quote_id,
-    payload: AcceptQuoteIn,
-    db: AsyncSession = Depends(get_db),
-    actor: str = Depends(get_actor),
-    _auth=Depends(_procurement_writer),
+    quote_id, payload: AcceptQuoteIn, db: AsyncSession = Depends(get_db), actor: str = Depends(get_actor)
 ):
     quote = await quote_service.accept_quote(db, quote_id, payload, actor)
     return {"data": await _accept_response(db, quote)}
@@ -245,12 +224,7 @@ async def _accept_response(db: AsyncSession, quote: Quote) -> dict:
 
 
 @router.patch("/{quote_id}/arrive")
-async def arrive_quote(
-    quote_id,
-    db: AsyncSession = Depends(get_db),
-    actor: str = Depends(get_actor),
-    _auth=Depends(_procurement_writer),
-):
+async def arrive_quote(quote_id, db: AsyncSession = Depends(get_db), actor: str = Depends(get_actor)):
     quote = await quote_service.arrive_quote(db, quote_id, actor)
     return {
         "data": {
@@ -263,11 +237,7 @@ async def arrive_quote(
 
 @router.patch("/{quote_id}/arrive-items")
 async def arrive_items(
-    quote_id,
-    payload: ArriveItemsIn,
-    db: AsyncSession = Depends(get_db),
-    actor: str = Depends(get_actor),
-    _auth=Depends(_procurement_writer),
+    quote_id, payload: ArriveItemsIn, db: AsyncSession = Depends(get_db), actor: str = Depends(get_actor)
 ):
     quote = await quote_service.arrive_items(db, quote_id, payload, actor)
     return {
@@ -289,23 +259,14 @@ async def arrive_items(
 
 @router.patch("/{quote_id}/reject")
 async def reject_quote(
-    quote_id,
-    payload: RejectQuoteIn | None = None,
-    db: AsyncSession = Depends(get_db),
-    actor: str = Depends(get_actor),
-    _auth=Depends(_procurement_writer),
+    quote_id, payload: RejectQuoteIn | None = None, db: AsyncSession = Depends(get_db), actor: str = Depends(get_actor)
 ):
     quote = await quote_service.reject_quote(db, quote_id, payload or RejectQuoteIn(), actor)
     return {"data": {"id": str(quote.id), "status": quote.status}}
 
 
 @router.patch("/{quote_id}/expire")
-async def expire_quote(
-    quote_id,
-    db: AsyncSession = Depends(get_db),
-    actor: str = Depends(get_actor),
-    _auth=Depends(_procurement_writer),
-):
+async def expire_quote(quote_id, db: AsyncSession = Depends(get_db), actor: str = Depends(get_actor)):
     quote = await quote_service.expire_quote(db, quote_id, actor)
     return {"data": {"id": str(quote.id), "status": quote.status}}
 
@@ -315,10 +276,6 @@ async def expire_quote(
 # ---------------------------------------------------------------------------
 
 @router.delete("/{quote_id}")
-async def delete_quote(
-    quote_id,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
+async def delete_quote(quote_id, db: AsyncSession = Depends(get_db)):
     result = await quote_service.delete_quote(db, quote_id)
     return {"data": result}