feat(client)!: 2026-05-14 spec drift sweep + CVE bumps

Combined output of:

1. ``poe refresh-upstream-spec`` — fresh live-gateway OAS + README.io portal
   spec.
2. Manual prose-drift audit (5 parallel sub-agents across all API areas)
   comparing per-object README.io reference pages against the local spec.
   The reference markdown corpus those agents read lives in PR #743; this
   PR focuses on the spec edits that came out of the audit.
3. Live-API verification for fields that can't be confirmed from docs alone.

## Spec changes

### New schema fields (additive)

- ``Variant.abc_classification`` (enum ``A`` / ``B`` / ``C``, nullable). New
  shared ``AbcClassification`` enum schema.
- ``SalesOrderRow.serial_number_transactions`` (array of
  ``{serial_number_id, quantity: 0|1}`` — Katana's audit trail of serial-number
  add/remove actions).
- ``UpdateManufacturingOrderOperationRowRequest.manufacturing_order_id``
  property added; ``manufacturing_order_id`` + ``status`` now required.
- ``UpdateProductRequest.configs.items.id`` optional integer (lets callers
  rename a config by id instead of matching by name).

### Wire-format types: ``number`` → ``string`` on read schemas

Katana returns fixed-precision decimals as strings on the wire
(``"0.0300000000"``). Our generated client previously typed these as
``float``, which the pydantic client silently coerced (lossy precision) and
the attrs client passed through as ``str`` while claiming ``float`` (runtime
type lie). The read schemas now match what the wire delivers:

- ``SalesOrderRow.price_per_unit``, ``cogs_value``
- ``ManufacturingOrderRecipeRow.planned_quantity_per_unit``
- ``ManufacturingOrderOperationRow.planned_time_per_unit``,
  ``planned_time_parameter``, ``total_actual_time``,
  ``planned_cost_per_unit``, ``total_actual_cost``

Write-side DTOs (``Create*Request``, ``Update*Request``) keep ``number`` —
the API accepts numeric input on write.

### Removed schemas / new endpoints

- ``SalesOrderSearchRequest`` and ``SalesOrderSearchRequestFilter`` removed;
  ``POST /sales_orders/search`` now references the consolidated
  ``SearchFilterRequest``.
- New endpoint ``POST /sales_order_rows/search`` — LoopBack-style filter
  envelope, returns ``SalesOrderRowListResponse``. Response shape verified
  against live API (issue #733 closed).
- New ``SearchFilterRequest`` schema (shared by both search endpoints).

### Relaxed-required + renames

- ``CreatePurchaseOrderRequest.order_no`` and
  ``CreateSalesOrderRequest.order_no`` no longer required — Katana
  auto-generates a sequential PO/SO number when omitted.
- ``CreateSalesOrderRowRequest.attributes.items.name`` → ``key`` (renamed
  to match the read schema's ``SalesOrderRowAttribute``). Same change on
  ``UpdateSalesOrderRowRequest``.

### Other field-level corrections

- ``CreateVariantRequest.registered_barcode`` — removed ``minLength: 3``,
  widened ``maxLength`` 40 → 120 to match Update + upstream.
- ``CreateSerialNumbersRequest`` — ``resource_type`` and ``serial_numbers``
  added to ``required``.
- ``CreateStockTransferRequest.stock_transfer_number`` +
  ``CreateStockAdjustmentRequest.stock_adjustment_number`` — added
  ``minLength: 1``.
- ``Inventory.safety_stock_level`` — added to ``required`` (live API always
  populates the field).
- ``DemandForecastPeriod.in_stock`` description fixed: "at the start" → "at
  the end of the period".
- ``PurchaseOrderRow.price_per_unit`` description copy-paste typo fixed
  ("sales price… in sales order currency" → "purchase price… in purchase
  order currency").
- ``Webhook.subscribed_events.items`` now ``$ref``'s the ``WebhookEvent``
  enum (previously a free-form string); stale example event names removed.
- ``CreateSalesOrderFulfillmentRequest.tracking_number`` / ``tracking_url``
  — added missing ``maxLength`` constraints (256 / 2048).
- Deprecation markers added to ``cost_per_hour`` /
  ``planned_time_per_unit`` across ``ManufacturingOrderOperationRow``, its
  Create / Update siblings, and ``ProductOperationRow`` (upstream documents
  these as superseded by ``cost_parameter`` / ``planned_time_parameter``).

## Supporting changes

- ``scripts/generate_pydantic_models.py`` — ``serial_number_transactions``
  added to ``SalesOrderRow``'s ``json_columns`` so the cached SQLModel
  serializes it via ``PydanticJSON``.
- ``katana_mcp_server/src/katana_mcp/tools/tool_result_utils.py`` — new
  ``float_or_none`` helper for coercing wire-format decimal strings at the
  domain boundary.
- ``katana_mcp_server/src/katana_mcp/tools/foundation/sales_orders.py`` —
  ``SalesOrderRowInfo`` / ``SalesOrderRowDetail`` mappings now route
  ``price_per_unit`` / ``cogs_value`` through ``float_or_none`` so the
  consumer-facing models stay numeric.
- Test factories (``katana_mcp_server/tests/factories.py``) accept
  ``float | str | None`` and stringify internally for caller convenience.

## CVE bumps

Pre-existing transitive vulnerabilities flagged by Trivy when this PR's
``uv.lock`` changes made them appear in the diff. Bumping in-place to the
fixed versions:

- ``gitpython`` 3.1.46 → 3.1.50 (CVE-2026-42215, -42284, -44243, -44244,
  GHSA-mv93-w799-cj2w). Transitive via ``python-semantic-release``.
- ``python-multipart`` 0.0.24 → 0.0.28 (CVE-2026-42561). Transitive via the
  MCP tooling chain.
- ``cryptography`` 46.0.6 → 48.0.0 (CVE-2026-39892). Transitive via
  ``pyjwt[crypto]``.

## Deferred work

Tier 2 findings from the audit that require live-API verification before
applying are tracked separately as #736 (items), #737 (customers/custom
fields/webhooks), #738 (inventory/stock), #739 (sales). The unverified
money-fields wire-format sweep continues in #735.

BREAKING CHANGE: Multiple field types narrowed from ``number`` to ``string``
on read schemas (``SalesOrderRow.price_per_unit`` / ``cogs_value``,
``ManufacturingOrderRecipeRow.planned_quantity_per_unit``,
``ManufacturingOrderOperationRow.planned_time_per_unit`` /
``planned_time_parameter`` / ``total_actual_time`` /
``planned_cost_per_unit`` / ``total_actual_cost``). Consumers doing
arithmetic on these need to parse them (e.g., ``float(row.price_per_unit)``
or ``decimal.Decimal(row.price_per_unit)``); pydantic clients in lax mode
will continue to auto-coerce. The ``SalesOrderSearchRequest`` /
``SalesOrderSearchRequestFilter`` classes are removed — callers of
``POST /sales_orders/search`` should switch to ``SearchFilterRequest``.
``SalesOrderRow``'s ``attributes.items`` request field is renamed
``name`` → ``key`` on Create / Update DTOs (matches the read shape).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: dougborg

docs/katana-openapi.yaml

@@ -1049,7 +1049,6 @@ components:
           maximum: 2147483647
           type: integer
       required:
-      - order_no
       - supplier_id
       - location_id
       - purchase_order_rows
@@ -1284,6 +1283,10 @@ components:
                   type: object
                 nullable: false
                 type: array
+              custom_fields:
+                additionalProperties: true
+                nullable: true
+                type: object
               location_id:
                 maximum: 2147483647
                 minimum: 1
@@ -1338,7 +1341,6 @@ components:
           nullable: true
           type: string
       required:
-      - order_no
       - customer_id
       - sales_order_rows
       title: CreateSalesOrderDto
@@ -1455,6 +1457,10 @@ components:
             type: object
           nullable: false
           type: array
+        custom_fields:
+          additionalProperties: true
+          nullable: true
+          type: object
         location_id:
           maximum: 2147483647
           minimum: 1
@@ -3572,6 +3578,10 @@ components:
             type: object
           nullable: false
           type: array
+        custom_fields:
+          additionalProperties: true
+          nullable: true
+          type: object
         location_id:
           maximum: 2147483647
           minimum: 1
@@ -7708,6 +7718,22 @@ paths:
       - SalesOrderRowController
       x-controller-name: SalesOrderRowController
       x-operation-name: createSalesOrderRow
+  /sales_order_rows/search:
+    post:
+      operationId: SalesOrderRowController.searchSalesOrderRows
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/SearchFilterDto'
+        required: true
+      responses:
+        '200':
+          description: Return value of SalesOrderRowController.searchSalesOrderRows
+      tags:
+      - SalesOrderRowController
+      x-controller-name: SalesOrderRowController
+      x-operation-name: searchSalesOrderRows
   /sales_order_rows/{id}:
     delete:
       operationId: SalesOrderRowController.deleteSalesOrderRow