fix(backend): arrival-confirmation 500, receipt state, RBAC, Casdoor user sync

- pm.py/inventory.py: remove db.begin() on already-begun sessions — the
  scope dependencies read from the session first, so opening a new
  transaction raised InvalidRequestError -> 500 on every receipt/transaction
  (JWT path); get_db already commits/rolls back atomically
- pm.py: receipt response returns the real derived state (was hardcoded
  'arrived'); dev-user creation is race-free (insert on conflict)
- expand_service: aggregate 1:N receipts per line item (received_qty sum +
  count) so the ledger can show partial-receipt totals
- users.py: role changes are admin-only (RBAC); new POST /users/sync mirrors
  Casdoor org users into the app users table (identity only, roles untouched)
- config/compose: CASDOOR_ADMIN_USER/PASSWORD for the sync endpoint
- seed_casdoor: redirect URI updated for the Traefik edge

backend/app/config.py

@@ -49,6 +49,11 @@ class Settings(BaseSettings):
     CASDOOR_JWKS_URL: str = ""  # default: {endpoint}/api/public_jwks
     CASDOOR_AUDIENCE: str = "inventory-app-client"  # expected token aud (falls back to client_id)
 
+    # Casdoor console admin — used by POST /users/sync to mirror Casdoor
+    # identities into the app's users table (dev defaults: admin / 123).
+    CASDOOR_ADMIN_USER: str = "admin"
+    CASDOOR_ADMIN_PASSWORD: str = "123"
+
     # Inventory dev fallback (only when no Authorization header is sent).
     INVENTORY_DEFAULT_ROLE: str = "pm"
     INVENTORY_DEFAULT_PROJECT_ID: str = ""