fix: medium audit items — CORS config, invoice description, path helper, node failure, order prefix

M3: cors_origins setting in config.py (env CORS_ORIGINS); main.py reads from settings.
M4: add build_order_line_step_render_dir() to render_paths.py; tasks.py drops placeholder.mp4 trick.
M5: unknown workflow graph nodes now fail the run (status="failed" + logger.error) instead of silently skipping.
M6: invoice line description is now "{product} — {output_type}" instead of bare UUID; eager-loads relations.
M7: order_number_prefix setting in config.py (env ORDER_NUMBER_PREFIX, default "SA").

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/domains/billing/service.py

@@ -248,15 +248,21 @@ async def create_invoice(
 
     total_net = Decimal("0")
     for ol_id in order_line_ids:
-        result = await db.execute(select(OrderLine).where(OrderLine.id == ol_id))
+        result = await db.execute(
+            select(OrderLine)
+            .options(selectinload(OrderLine.product), selectinload(OrderLine.output_type))
+            .where(OrderLine.id == ol_id)
+        )
         ol = result.scalar_one_or_none()
         if not ol:
             continue
+        product_name = ol.product.name if ol.product else "Unknown product"
+        ot_name = ol.output_type.name if ol.output_type else "Unknown output type"
         unit_price = ol.unit_price or Decimal("0")
         line = InvoiceLine(
             invoice_id=invoice.id,
             order_line_id=ol.id,
-            description=f"Render: {ol.id}",
+            description=f"{product_name} — {ot_name}",
             quantity=1,
             unit_price=unit_price,
             total=unit_price,