fix(numbering): post-review fixes — credit notes, SO unlink, multi-part grouping, SQL whitelist

- B1: Add Credit Note wizard path was blocked because invoice_origin
  has copy=False and the wizard doesn't set fp_from_so_invoice. Now
  the validator allows reversals when reversed_entry_id points at a
  customer-facing move that itself went through the validator at
  original creation time. account.move._fp_parent_sale_order also
  walks self.reversed_entry_id._fp_parent_sale_order so the credit
  note inherits the parent number (CN-<parent>).

- Bug 1: sale.order.unlink() now blocks deletion when x_fc_parent_number
  is set (matches spec §6.2). Draft quotes remain freely deletable
  per Odoo standard. Applies to all users including admins.

- Bug 2: out_receipt added to CUSTOMER_TYPES so POS-style receipts
  hit the same SO-flow gate as out_invoice / out_refund.

- C1: WO grouping key changed from recipe.id to (recipe.id, part.id,
  coating.id). Bundling lines with different parts under one WO put
  first_line's part_number on the CoC header — silent compliance
  mis-attestation. Now distinct parts always get distinct WOs even
  when they share a recipe.

- C3: SQL whitelist (_FP_COUNTER_FIELD_RE) on _fp_assign_parent_name's
  interpolated counter field name. No user input today; defence in
  depth for future subclasses that might read the name from context.

Verified on entech: parent=30017, credit note = CN-30017,
multi-part SO produces 2 WOs (one per part), confirmed-SO unlink
blocked, out_receipt blocked, whitelist regex enforced.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

fusion_plating/fusion_plating_jobs/models/account_move.py

@@ -24,7 +24,7 @@ from odoo.tools.translate import _
 
 _logger = logging.getLogger(__name__)
 
-CUSTOMER_TYPES = ('out_invoice', 'out_refund')
+CUSTOMER_TYPES = ('out_invoice', 'out_refund', 'out_receipt')
 
 
 class AccountMove(models.Model):
@@ -35,16 +35,27 @@ class AccountMove(models.Model):
     # =================================================================
     def _fp_parent_sale_order(self):
         """Find linked SO via SO context flag (set by _create_invoices),
-        or fall back to invoice_origin name match."""
+        or fall back to invoice_origin name match, then to the reversed
+        entry's SO (for the Add Credit Note path where invoice_origin
+        has copy=False and doesn't survive the move.copy())."""
         so_id = self.env.context.get('fp_invoice_source_so_id')
         if so_id:
             so = self.env['sale.order'].browse(so_id).exists()
             if so:
                 return so
         if self.invoice_origin:
-            return self.env['sale.order'].search(
+            so = self.env['sale.order'].search(
                 [('name', '=', self.invoice_origin)], limit=1,
             )
+            if so:
+                return so
+        # Reversal path: read the parent move's SO link so the credit
+        # note's name flows from the same parent number as the invoice
+        # it's reversing.
+        if self.reversed_entry_id:
+            parent_so = self.reversed_entry_id._fp_parent_sale_order()
+            if parent_so:
+                return parent_so
         return self.env['sale.order']
 
     def _fp_name_prefix(self):
@@ -68,8 +79,9 @@ class AccountMove(models.Model):
 
     @api.model
     def _fp_validate_customer_invoice(self, vals):
-        """Refuse out_invoice / out_refund creation that didn't come
-        through the SO workflow. Applies to ALL users including admins."""
+        """Refuse out_invoice / out_refund / out_receipt creation that
+        didn't come through the SO workflow. Applies to ALL users
+        including admins."""
         mtype = vals.get('move_type', 'entry')
         if mtype not in CUSTOMER_TYPES:
             return
@@ -80,10 +92,22 @@ class AccountMove(models.Model):
             [('name', '=', origin)]
         ):
             return
+        # Credit-note / reversal path: Odoo's "Add Credit Note" wizard
+        # calls move.copy() with reversed_entry_id set in the defaults,
+        # but invoice_origin has copy=False on the standard field so
+        # it doesn't survive the copy. Allow reversals through as long
+        # as the reversed entry is itself a customer-facing move (which
+        # means it already went through this validator at original
+        # creation time — the audit trail is intact).
+        reversed_id = vals.get('reversed_entry_id')
+        if reversed_id:
+            parent = self.env['account.move'].sudo().browse(reversed_id)
+            if parent.exists() and parent.move_type in CUSTOMER_TYPES:
+                return
         raise UserError(_(
-            'Customer invoices and credit notes must be created from a '
-            'Sale Order. Open the originating SO and use the Create '
-            'Invoice / Add Credit Note action.\n\n'
+            'Customer invoices, credit notes, and receipts must be '
+            'created from a Sale Order. Open the originating SO and '
+            'use the Create Invoice / Add Credit Note action.\n\n'
             'This rule applies to all users including administrators. '
             'It is enforced to keep the parent-number audit trail '
             'intact (see fusion_plating numbering policy).'