feat: backend MVP (auth/rbac, catalog, orders, fulfillment, invoices) + specs + scaffolds

openspec/changes/cart-checkout-orders/tasks.md

@@ -0,0 +1,17 @@
+# Tasks: cart-checkout-orders
+
+## 1. Schema
+- [ ] Migration: orders, order_items; order status enum; order_no sequence
+
+## 2. Cart (Redis)
+- [ ] GET /api/cart, POST /api/cart/items, PUT/DELETE /api/cart/items/{sku_id}
+- [ ] Cart read joins SKU/product snapshots; rejects inactive/unpublished SKUs
+
+## 3. Checkout & orders
+- [ ] POST /api/orders/checkout (one order per shop, tx: stock decrement + order insert, cart clear)
+- [ ] GET /api/orders (mine, paged), GET /api/orders/{id}
+- [ ] POST /api/orders/{id}/pay (mock) and /cancel with state rules
+- [ ] GET /api/shop/orders for merchants; platform admin list
+
+## 4. Tests
+- [ ] cargo test: multi-shop checkout splits orders, insufficient stock → 409, cancel rules, stock restored on cancel