fix: medium audit items — CORS config, invoice description, path helper, node failure, order prefix

M3: cors_origins setting in config.py (env CORS_ORIGINS); main.py reads from settings.
M4: add build_order_line_step_render_dir() to render_paths.py; tasks.py drops placeholder.mp4 trick.
M5: unknown workflow graph nodes now fail the run (status="failed" + logger.error) instead of silently skipping.
M6: invoice line description is now "{product} — {output_type}" instead of bare UUID; eager-loads relations.
M7: order_number_prefix setting in config.py (env ORDER_NUMBER_PREFIX, default "SA").

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/core/render_paths.py

@@ -181,6 +181,19 @@ def build_order_line_step_render_path(
     return artifact_dir / filename
 
 
+def build_order_line_step_render_dir(
+    step_path: str | Path,
+    order_line_id: str,
+    *,
+    ensure_exists: bool = False,
+) -> Path:
+    """Return the per-order-line render artifact directory beside the STEP file."""
+    artifact_dir = Path(step_path).parent / "renders" / str(order_line_id)
+    if ensure_exists:
+        ensure_group_writable_dir(artifact_dir)
+    return artifact_dir
+
+
 def build_order_line_export_path(
     order_line_id: str,
     filename: str,