feat: add admin pricing workflow

Add the admin pricing observation and valuation form, secure valuation writes with CSRF, and extend authenticated browser coverage.

apps/api/src/modules/pricing/routes/admin-pricing-routes.js

@@ -36,6 +36,7 @@ export async function registerAdminPricingRoutes(app, options) {
   });
 
   app.post('/inventory/:id/valuation', async (request, reply) => {
+    await authorizeUnsafeRequest?.(request.cookies[sessionCookieName], request.headers['x-csrf-token']);
     const valuation = await pricingService.calculate({ sellerId: request.admin.sellerId, inventoryItemId: request.params.id });
     return reply.code(200).send({ data: toAdminMarketValuationDto(valuation) });
   });

apps/api/tests/http/pricing-routes.test.js

@@ -24,5 +24,5 @@ test('accepts a protected pricing observation and valuation request', async (tes
   assert.equal(observationResponse.statusCode, 201);
   assert.equal(valuationResponse.statusCode, 200);
   assert.equal(valuationResponse.json().data.valueMinor, 2500);
-  assert.equal(csrfChecks, 1);
+  assert.equal(csrfChecks, 2);
 });