feat(vendor-spec): BOM import, LOT autocomplete, pricing, partnumber_seen push

- BOM paste: auto-detect columns by content (price, qty, PN, description);
  handles $5,114.00 and European comma-decimal formats
- LOT input: HTML5 datalist rebuilt on each renderBOMTable from allComponents;
  oninput updates data only (no re-render), onchange validates+resolves
- BOM persistence: PUT handler explicitly marshals VendorSpec to JSON string
  (GORM Update does not reliably call driver.Valuer for custom types)
- BOM autosave after every resolveBOM() call
- Pricing tab: async renderPricingTab() calls /api/quote/price-levels for all
  resolved LOTs directly — Estimate prices shown even before cart apply
- Unresolved PNs pushed to qt_vendor_partnumber_seen via POST
  /api/sync/partnumber-seen (fire-and-forget from JS)
- sync.PushPartnumberSeen(): upsert with ON DUPLICATE KEY UPDATE last_seen_at
- partnumber_books: pull ALL books (not only is_active=1); re-pull items when
  header exists but item count is 0; fallback for missing description column
- partnumber_books UI: collapsible snapshot section (collapsed by default),
  pagination (10/page), sync button always visible in header
- vendorSpec handlers: use GetConfigurationByUUID + IsActive check (removed
  original_username from WHERE — GetUsername returns "" without JWT)
- bible/09-vendor-spec.md: updated with all architectural decisions

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

bible/04-api.md

@@ -92,6 +92,25 @@
 
 **If sync is blocked by the readiness guard:** all POST sync methods return `423 Locked` with `reason_code` and `reason_text`.
 
+### Vendor Spec (BOM)
+
+| Method | Endpoint | Purpose |
+|--------|----------|---------|
+| GET | `/api/configs/:uuid/vendor-spec` | Fetch stored vendor BOM |
+| PUT | `/api/configs/:uuid/vendor-spec` | Replace vendor BOM (full update) |
+| POST | `/api/configs/:uuid/vendor-spec/resolve` | Resolve PNs → LOTs (read-only) |
+| POST | `/api/configs/:uuid/vendor-spec/apply` | Apply resolved LOTs to cart |
+
+### Partnumber Books (read-only)
+
+| Method | Endpoint | Purpose |
+|--------|----------|---------|
+| GET | `/api/partnumber-books` | List local book snapshots |
+| GET | `/api/partnumber-books/:id` | Items for a book by `server_id` |
+| POST | `/api/sync/partnumber-books` | Pull book snapshots from MariaDB |
+
+See [09-vendor-spec.md](09-vendor-spec.md) for schema and pull logic.
+
 ### Export
 
 | Method | Endpoint | Purpose |
@@ -114,6 +133,7 @@
 | `/projects/:uuid` | Project details |
 | `/pricelists` | Pricelist list |
 | `/pricelists/:id` | Pricelist details |
+| `/partnumber-books` | Partnumber books (active book summary + snapshot history) |
 | `/setup` | Connection settings |
 
 ---