feat(security): JWT required on every API route, gated dev fallback, role checks

- main.py: global get_current_user dependency on all routers except
  /auth/login and /health; prod fail-fast startup guard rejects wildcard
  CORS, default credentials, DEV_LOGIN_ENABLED
- inventory/pm: X-User-Role header identity fallback now only active when
  PROCUREMENT_DEV_LOGIN_ENABLED=true (was unconditional in production)
- item_decisions writes + attachment deletes: require_role(
  procurement_manager, admin) — require_role was defined but never used
- config.py: ENVIRONMENT flag, comma-separated CORS_ORIGINS, no default
  Casdoor client secret/admin password, DEV_LOGIN_ENABLED=false
- frontend: authenticated file downloads (Bearer + blob) — <a href> links
  cannot send the token; FileList/QuoteDetail/AcceptModal/EditModal/
  PurchaseHistory converted; DEV_LOGIN_ENABLED build arg defaults false
- smoke tests authenticate via POST /auth/login (SMOKE_USER/SMOKE_PASSWORD)
- traefik: security headers, API rate limit, 12MB body cap (prod overlay)
- nginx client_max_body_size aligned to 12MB

frontend/src/components/FileList.tsx

@@ -9,13 +9,13 @@ export interface FileListProps {
   upload: (file: File) => Promise<Attachment>;
   // حذف سمت سرور (اختیاری — بعد از حذف محلی صدا زده می‌شود)
   onDelete?: (a: Attachment) => void;
-  // لینک دانلود؛ null یعنی هنوز آپلود نشده
-  urlOf?: (a: Attachment) => string | null;
+  // دانلود احراز هویت‌شده (توکن Bearer + blob — لینک خام توکن نمی‌فرستد)
+  onDownload?: (a: Attachment) => void | Promise<void>;
   label?: string;
 }
 
 // مدیریت چند فاکتور: آپلود مستقیم به سرور (MinIO) + دانلود/حذف فایل‌های ذخیره‌شده
-export function FileList({ files, onChange, upload, onDelete, urlOf, label = "افزودن فاکتور" }: FileListProps) {
+export function FileList({ files, onChange, upload, onDelete, onDownload, label = "افزودن فاکتور" }: FileListProps) {
   const inputRef = useRef<HTMLInputElement | null>(null);
 
   const remove = (i: number) => {
@@ -45,10 +45,19 @@ export function FileList({ files, onChange, upload, onDelete, urlOf, label = "ا
       {files.map((inv, i) => (
         <div key={i} className="inv-row">
           <span className="inv-name">📎 {inv.name}</span>
-          {urlOf?.(inv) && (
-            <a className="inv-open" href={urlOf(inv)!} download={inv.name} title="دانلود">
+          {onDownload && (
+            <button
+              type="button"
+              className="inv-open"
+              title="دانلود"
+              onClick={() => {
+                Promise.resolve(onDownload(inv)).catch((err) =>
+                  toast.error(err instanceof Error ? err.message : "دانلود فایل ناموفق بود"),
+                );
+              }}
+            >
               ↓
-            </a>
+            </button>
           )}
           <button type="button" className="inv-x" title="حذف" onClick={() => remove(i)}>
             ×