refactor(section-d): frontend API client type safety audit

All 19 api/*.ts files already used import api from './client' (X-Tenant-ID
guaranteed). Fixed missing type generics and any usage in 10 files:
- worker.ts: args: any[] → unknown[]
- imports.ts, notifications.ts: add response type generics
- renderTemplates.ts: add typed generics on 6 calls
- materials.ts, cad.ts: type previously untyped api calls
- products.ts: ProductCadUploadResponse interface, typed generics
- uploads.ts: StepUploadResponse interface
- billing.ts, orders.ts: <Blob> on download calls

Zero bare axios usage, zero as any in API layer.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/api/orders.ts

@@ -46,6 +46,8 @@ export interface Order {
   updated_at: string
   submitted_at: string | null
   completed_at: string | null
+  rejected_at: string | null
+  rejection_reason: string | null
   estimated_price: number | null
   item_count: number
   line_count: number
@@ -239,8 +241,21 @@ export async function generateLinesFromItems(
   return res.data
 }
 
+export async function rejectOrder(orderId: string, reason: string, notifyClient: boolean = true): Promise<Order> {
+  const res = await api.post<Order>(`/orders/${orderId}/reject`, {
+    reason,
+    notify_client: notifyClient,
+  })
+  return res.data
+}
+
+export async function resubmitOrder(orderId: string): Promise<Order> {
+  const res = await api.post<Order>(`/orders/${orderId}/resubmit`)
+  return res.data
+}
+
 export async function downloadOrderRenders(orderId: string, orderNumber: string): Promise<void> {
-  const res = await api.get(`/orders/${orderId}/download-renders`, { responseType: 'blob' })
+  const res = await api.get<Blob>(`/orders/${orderId}/download-renders`, { responseType: 'blob' })
   const url = URL.createObjectURL(res.data)
   const a = document.createElement('a')
   a.href = url