fix(backend): arrival-confirmation 500, receipt state, RBAC, Casdoor user sync

- pm.py/inventory.py: remove db.begin() on already-begun sessions — the
  scope dependencies read from the session first, so opening a new
  transaction raised InvalidRequestError -> 500 on every receipt/transaction
  (JWT path); get_db already commits/rolls back atomically
- pm.py: receipt response returns the real derived state (was hardcoded
  'arrived'); dev-user creation is race-free (insert on conflict)
- expand_service: aggregate 1:N receipts per line item (received_qty sum +
  count) so the ledger can show partial-receipt totals
- users.py: role changes are admin-only (RBAC); new POST /users/sync mirrors
  Casdoor org users into the app users table (identity only, roles untouched)
- config/compose: CASDOOR_ADMIN_USER/PASSWORD for the sync endpoint
- seed_casdoor: redirect URI updated for the Traefik edge

backend/tools/seed_casdoor.py

@@ -28,7 +28,7 @@ ORG = "inventory"
 APP = "inventory-app"
 CLIENT_ID = "inventory-app-client"
 CLIENT_SECRET = "inventory-app-secret-2026"
-REDIRECT_URI = "http://localhost:3000/login"
+REDIRECT_URI = "http://localhost/login"  # Traefik edge (v1.3); unused by the in-page flow
 
 USERS = [
     # (name, first_name, last_name, email, password)