fusion_authorizer_portal: wire accessibility assessments into MOD/ODSP/WSIB workflows (v19.0.2.8.0)

Audit found that fusion.accessibility.assessment._create_draft_sale_order
hardcoded x_fc_sale_type='direct_private' for ALL accessibility cases —
meaning MOD, ODSP, WSIB, and insurance projects never entered their
respective downstream workflows. The MOD workflow rework I shipped in
fusion_claims 19.0.8.0.3 was effectively unreachable from the portal.

Also: x_fc_authorizer_id never propagated from the assessment to the SO,
the new x_fc_mod_accessibility_specialist_id was orphaned, and there
was no back-reference from sale.order to the accessibility assessment.

Fixes:
- New required field x_fc_funding_source on fusion.accessibility.assessment
  (march_of_dimes / odsp / wsib / insurance / direct_private / other)
- _create_draft_sale_order now maps funding_source -> x_fc_sale_type,
  copies authorizer_id -> x_fc_authorizer_id, sets accessibility_assessment_id
  back-ref, and for MOD cases pre-populates
  x_fc_mod_accessibility_specialist_id from sales_rep_id.partner_id
- New accessibility_assessment_id field on sale.order so the back-link
  is queryable both directions (previously only assessment->SO existed)
- action_complete now guards against double-completion and missing
  funding_source: raises UserError instead of silently creating duplicates
- Expanded fusion.accessibility.assessment.state from 3 to 6 values
  (draft/scheduled/in_progress/pending_review/completed/cancelled),
  added copy=False, added _expand_states group_expand for kanban
- Booking form at /book-assessment now collects funding_source
  (required dropdown) so the path is known before the visit happens
- portal_assessment.py book_assessment_submit accepts funding_source
  with whitelist validation (defaults to direct_private if missing)

Deployed to odoo-westin (westin-v19) and odoo-mobility (mobility),
both verified at v19.0.2.8.0 with the new columns present.

fusion_authorizer_portal/controllers/portal_assessment.py

@@ -1097,6 +1097,18 @@ class AssessmentPortal(CustomerPortal):
             if kw.get('client_postal'):
                 address_parts.append(kw['client_postal'])
 
+            # 2026-04 portal audit fix — accept funding source from the form
+            # so the generated sale order enters the correct workflow. Defaults
+            # to direct_private for backwards compatibility if the form field
+            # is missing (old cached browsers, legacy API calls).
+            valid_funding_sources = (
+                'march_of_dimes', 'odsp', 'wsib',
+                'insurance', 'direct_private', 'other',
+            )
+            funding_source = kw.get('funding_source', 'direct_private')
+            if funding_source not in valid_funding_sources:
+                funding_source = 'direct_private'
+
             vals = {
                 'assessment_type': kw['assessment_type'],
                 'client_name': kw['client_name'],
@@ -1110,6 +1122,7 @@ class AssessmentPortal(CustomerPortal):
                 'assessment_date': assessment_date,
                 'booking_source': booking_source,
                 'modification_requested': kw.get('modification_requested', ''),
+                'x_fc_funding_source': funding_source,
             }
 
             if sales_rep_id: