fix(backend): arrival-confirmation 500, receipt state, RBAC, Casdoor user sync

- pm.py/inventory.py: remove db.begin() on already-begun sessions — the
  scope dependencies read from the session first, so opening a new
  transaction raised InvalidRequestError -> 500 on every receipt/transaction
  (JWT path); get_db already commits/rolls back atomically
- pm.py: receipt response returns the real derived state (was hardcoded
  'arrived'); dev-user creation is race-free (insert on conflict)
- expand_service: aggregate 1:N receipts per line item (received_qty sum +
  count) so the ledger can show partial-receipt totals
- users.py: role changes are admin-only (RBAC); new POST /users/sync mirrors
  Casdoor org users into the app users table (identity only, roles untouched)
- config/compose: CASDOOR_ADMIN_USER/PASSWORD for the sync endpoint
- seed_casdoor: redirect URI updated for the Traefik edge

backend/app/routers/inventory.py

@@ -10,6 +10,7 @@ Authorization (v2.6):
 """
 import base64
 import uuid
+from contextlib import nullcontext
 from dataclasses import dataclass
 from decimal import Decimal
 
@@ -465,7 +466,10 @@ async def create_transaction(
     db: AsyncSession = Depends(get_db),
 ):
     _require_pm(scope)
-    async with db.begin():
+    # No explicit db.begin(): the session may already be inside an implicit
+    # transaction (inventory_scope read from it in the JWT path); get_db
+    # commits on success / rolls back on failure.
+    with nullcontext():
         wh = await get_warehouse_or_404(db, payload.warehouse_id)
         if wh.project_id != scope.project_id:
             raise ForbiddenError("این انبار متعلق به پروژه شما نیست")