fix: medium audit items — CORS config, invoice description, path helper, node failure, order prefix

M3: cors_origins setting in config.py (env CORS_ORIGINS); main.py reads from settings.
M4: add build_order_line_step_render_dir() to render_paths.py; tasks.py drops placeholder.mp4 trick.
M5: unknown workflow graph nodes now fail the run (status="failed" + logger.error) instead of silently skipping.
M6: invoice line description is now "{product} — {output_type}" instead of bare UUID; eager-loads relations.
M7: order_number_prefix setting in config.py (env ORDER_NUMBER_PREFIX, default "SA").

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/domains/rendering/workflow_graph_runtime.py

@@ -508,12 +508,17 @@ def execute_graph_workflow(
             continue
 
         metadata["execution_kind"] = definition.execution_kind if definition is not None else "bridge"
-        node_result.status = "skipped"
+        node_result.status = "failed"
         node_result.output = metadata
-        node_result.log = f"Graph runtime not implemented for step '{node.step.value}'"
+        node_result.log = f"No graph runtime executor for step '{node.step.value}' — add it to STEP_TASK_MAP or _BRIDGE_EXECUTORS"
         node_result.duration_s = None
+        logger.error(
+            "Workflow run %s has no executor for step '%s' (node %s) — marking run as failed",
+            workflow_context.workflow_run_id,
+            node.step.value,
+            node.id,
+        )
         session.flush()
-        skipped_node_ids.append(node.id)
 
     run.celery_task_id = task_ids[0] if task_ids else None
     if any(node_result.status == "failed" for node_result in run.node_results):