feat(M08-C): 补管理员订单处置与代下单

backend/tests/order-management.test.mjs

@@ -9,6 +9,7 @@ const token = signAccessToken({
 }, secret, 900);
 let called;
 let customerCalled;
+let noteCalled;
 const authRepository = {
   async validateSession() {
     return {
@@ -44,7 +45,10 @@ const app = await buildApp({
         return { orderId, adjustmentType: 'CHANGE_ROOM', amountDeltaCents: -500 };
       },
       async adjustTime() { throw new Error('not called'); },
-      async note() { throw new Error('not called'); },
+      async note(actor, orderId, note) {
+        noteCalled = { actor, orderId, note };
+        return { orderId, note };
+      },
       async cancellationQuote() {
         return { allowed: true, feeCents: 0, refundableCents: 3000 };
       }
@@ -80,6 +84,18 @@ assert.equal(called.orderId, '31');
 assert.equal(called.actor.traceId, 'm04c-renew-route');
 assert.equal(called.body.pricingPolicy, 'LOCKED');
 
+const managementNote = await app.inject({
+  method: 'POST',
+  url: '/app-api/management/orders/31/note',
+  headers: { authorization: `Bearer ${token}`, 'x-trace-id': 'm08c-management-note' },
+  payload: { note: 'front desk confirmed member arrival' }
+});
+assert.equal(managementNote.statusCode, 200);
+assert.equal(noteCalled.orderId, '31');
+assert.equal(noteCalled.actor.source, 'ADMIN');
+assert.equal(noteCalled.actor.traceId, 'm08c-management-note');
+assert.equal(noteCalled.note, 'front desk confirmed member arrival');
+
 const customerRenewed = await app.inject({
   method: 'POST',
   url: '/app-api/orders/31/renew',