fix: medium audit items — CORS config, invoice description, path helper, node failure, order prefix

M3: cors_origins setting in config.py (env CORS_ORIGINS); main.py reads from settings.
M4: add build_order_line_step_render_dir() to render_paths.py; tasks.py drops placeholder.mp4 trick.
M5: unknown workflow graph nodes now fail the run (status="failed" + logger.error) instead of silently skipping.
M6: invoice line description is now "{product} — {output_type}" instead of bare UUID; eager-loads relations.
M7: order_number_prefix setting in config.py (env ORDER_NUMBER_PREFIX, default "SA").

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/domains/orders/service.py

@@ -15,10 +15,11 @@ def _utcnow_naive() -> datetime:
 
 
 async def generate_order_number(db: AsyncSession) -> str:
-    """Generate next sequential order number: SA-YYYY-XXXXX."""
+    """Generate next sequential order number: {ORDER_NUMBER_PREFIX}-YYYY-XXXXX."""
     from sqlalchemy import text
+    from app.config import settings as _settings
     year = datetime.now(timezone.utc).year
-    prefix = f"SA-{year}-"
+    prefix = f"{_settings.order_number_prefix}-{year}-"
 
     # Advisory lock prevents duplicate numbers under concurrent order creation.
     # Released automatically when the surrounding transaction commits or rolls back.