fix: 404 unresolvable deal_id and quote_id on order create

[aleksUIX]

Summary

Fixes #68 and #70. POST /api/v1/orders wrote deal_id and quote_id straight through. An unknown deal_id persisted as a draft; a change request against that order then inherited the reference and reached pending_approval at material severity with validation_errors empty. An unknown quote_id did the same on a valid deal, so the order's quote disagreed with the deal's.

The adjacent hop already resolves its parent: POST /api/v1/deals returns 404 quote_not_found for the same missing quote. GET /api/v1/deals/{id} returns 404 deal_not_found. Orders now match that contract.

Omitted / null ids stay allowed. An order can still be drafted before commercial terms exist. A provided id must already be in storage.

Fix

In create_order, after get_storage():

• non-empty deal_id → storage.get_deal; miss → 404 deal_not_found (same detail as get_deal)
• non-empty quote_id → storage.get_quote; miss → 404 quote_not_found (same detail as book_deal / get_quote)
• nothing is persisted on either miss

For orders already stored with a phantom deal_id (the #68 change-request path), create_change_request does the same lookup after the order exists and before classifying severity or writing a CR. Empty / None is left alone so this does not collide with #65 (deal_id_required for dealless orders).

if deal_id:
    deal = await storage.get_deal(deal_id)
    if not deal:
        raise HTTPException(
            status_code=404,
            detail={"error": "deal_not_found", "message": f"Deal '{deal_id}' not found."},
        )
if quote_id:
    quote = await storage.get_quote(quote_id)
    if not quote:
        raise HTTPException(
            status_code=404,
            detail={"error": "quote_not_found", "message": f"Quote '{quote_id}' not found."},
        )

Out of scope (deliberate)

• Does not require a deal or quote on create. Draft-without-terms remains valid.
• Does not check that a resolvable quote_id belongs to the given deal (POST /api/v1/orders accepts and persists an unresolvable quote_id for a valid deal #70 explicitly untested).
• Does not take POST /api/v1/change-requests returns 500 for an order created without a deal_id #61 / fix: reject change requests for dealless orders #65: no None → "" write-side normalization, no deal_id_required 400. Those PRs compose: fix: reject change requests for dealless orders #65 rejects missing ids, this rejects present-but-unknown ids.
• Does not touch GAM reporting (gam_reporting_service consumption of order["deal_id"]). Once create refuses unknown ids, new orders cannot feed that path a phantom reference.

Test plan

• omitted ids still create a draft (existing test_create_order_returns_draft)
• seeded deal + quote still 200 and persist
• unknown deal_id → 404 deal_not_found, no order row (POST /api/v1/orders accepts an unresolvable deal_id, and the reference propagates into a material change request #68 curl)
• unknown quote_id → 404 quote_not_found, no order row (POST /api/v1/orders accepts and persists an unresolvable quote_id for a valid deal #70, including with a known deal)
• service-layer 404s match the HTTP tests
• change request against a booked order whose deal_id is not in storage → 404 deal_not_found, no CR record, never pending_approval with empty validation_errors
• uv run --locked ruff check src/ and ruff format --check clean
• full unit suite: 1445 passed

Closes #68
Closes #70