fix: medium audit items — CORS config, invoice description, path helper, node failure, order prefix

M3: cors_origins setting in config.py (env CORS_ORIGINS); main.py reads from settings.
M4: add build_order_line_step_render_dir() to render_paths.py; tasks.py drops placeholder.mp4 trick.
M5: unknown workflow graph nodes now fail the run (status="failed" + logger.error) instead of silently skipping.
M6: invoice line description is now "{product} — {output_type}" instead of bare UUID; eager-loads relations.
M7: order_number_prefix setting in config.py (env ORDER_NUMBER_PREFIX, default "SA").

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/domains/rendering/tasks.py

@@ -13,6 +13,7 @@ from pathlib import Path
 from app.core.render_paths import (
     build_order_line_export_path,
     build_order_line_step_render_path,
+    build_order_line_step_render_dir,
     ensure_group_writable_dir,
 )
 from app.tasks.celery_app import celery_app
@@ -931,20 +932,19 @@ def render_turntable_task(
         if not step_path:
             raise RuntimeError(f"Cannot resolve STEP path for order_line {order_line_id}")
         step = Path(step_path)
-        canonical_output_dir = build_order_line_step_render_path(
+        canonical_output_dir = build_order_line_step_render_dir(
             step,
             order_line_id,
-            "placeholder.mp4",
             ensure_exists=True,
         )
-        if output_dir and Path(output_dir) != canonical_output_dir.parent:
+        if output_dir and Path(output_dir) != canonical_output_dir:
             logger.warning(
                 "render_turntable_task overriding non-canonical output_dir=%s with %s for order_line=%s",
                 output_dir,
-                canonical_output_dir.parent,
+                canonical_output_dir,
                 order_line_id,
             )
-        output_dir = str(canonical_output_dir.parent)
+        output_dir = str(canonical_output_dir)
     elif output_dir is None:
         raise RuntimeError("render_turntable_task requires output_dir when invoked with a STEP path")
     else: