refactor(P11+P12): codebase hygiene — CLAUDE.md rewrite, type safety, dead code removal

- Rewrite CLAUDE.md to match current 8-service architecture (was 11, 5 deleted)
- Remove all as-any casts in OrderDetail.tsx (9 casts → 0)
- Add cad_parsed_objects/cad_part_materials to OrderItem interface
- Rename require_admin → require_global_admin across 6 router files (22 calls)
- Remove EXPORT_GLB_PRODUCTION enum + generate_gltf_production_task (dead code)
- Remove worker-thumbnail from ALLOWED_SERVICES, replace Flamenco link
- Delete obsolete PLAN.md (1455 lines) and PLAN_REFACTOR.md (1174 lines)
- Fix digit-only USD prim names with p_ prefix

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend/app/api/routers/worker.py

@@ -17,7 +17,7 @@ from app.models.product import Product
 from app.models.user import User
 from app.models.worker_config import WorkerConfig
 from app.models.system_setting import SystemSetting
-from app.utils.auth import get_current_user, require_admin_or_pm, require_admin
+from app.utils.auth import get_current_user, require_admin_or_pm, require_global_admin
 
 router = APIRouter(prefix="/worker", tags=["worker"])
 
@@ -364,7 +364,7 @@ async def cancel_task(task_id: str, user: User = Depends(require_admin_or_pm)):
 # ---------------------------------------------------------------------------
 
 class ScaleRequest(BaseModel):
-    service: str  # "render-worker" | "worker" | "worker-thumbnail"
+    service: str  # "render-worker" | "worker"
     count: int    # 0–20
 
 
@@ -411,7 +411,7 @@ async def scale_workers(
     body: ScaleRequest,
     user: User = Depends(require_admin_or_pm),
 ):
-    """Scale a Compose service (render-worker, worker, worker-thumbnail) up or down.
+    """Scale a Compose service (render-worker, worker) up or down.
 
     Requires the docker socket and compose file to be accessible inside the container
     (see docker-compose.yml COMPOSE_PROJECT_DIR env var).
@@ -421,7 +421,7 @@ async def scale_workers(
     import subprocess
     from fastapi import HTTPException
 
-    ALLOWED_SERVICES = {"render-worker", "worker", "worker-thumbnail"}
+    ALLOWED_SERVICES = {"render-worker", "worker"}
     if body.service not in ALLOWED_SERVICES:
         raise HTTPException(400, detail=f"service must be one of {ALLOWED_SERVICES}")
     if not (0 <= body.count <= 20):
@@ -462,7 +462,7 @@ async def scale_workers(
 # ---------------------------------------------------------------------------
 
 @router.post("/probe/gpu", status_code=http_status.HTTP_202_ACCEPTED)
-async def trigger_gpu_probe(current_user: User = Depends(require_admin)):
+async def trigger_gpu_probe(current_user: User = Depends(require_global_admin)):
     """Queue a GPU probe task on the render-worker."""
     from app.tasks.gpu_tasks import probe_gpu
     result = probe_gpu.delay()
@@ -471,7 +471,7 @@ async def trigger_gpu_probe(current_user: User = Depends(require_admin)):
 
 @router.get("/probe/gpu/result")
 async def get_gpu_probe_result(
-    current_user: User = Depends(require_admin),
+    current_user: User = Depends(require_global_admin),
     db: AsyncSession = Depends(get_db),
 ):
     """Return the last GPU probe result from system_settings."""
@@ -622,7 +622,7 @@ class WorkerConfigUpdate(BaseModel):
 
 @router.get("/configs", response_model=list[WorkerConfigOut])
 async def list_worker_configs(
-    user: User = Depends(require_admin),
+    user: User = Depends(require_global_admin),
     db: AsyncSession = Depends(get_db),
 ):
     """List all worker concurrency configurations (admin only)."""
@@ -644,7 +644,7 @@ async def list_worker_configs(
 async def update_worker_config(
     queue_name: str,
     body: WorkerConfigUpdate,
-    user: User = Depends(require_admin),
+    user: User = Depends(require_global_admin),
     db: AsyncSession = Depends(get_db),
 ):
     """Update concurrency settings for a specific queue (admin only)."""