fix(orders): cancelled orders cannot be reopened (stock restocked twice)

After refund + cancellation the stock rose by 2 instead of 1. Cause:
the status form allowed moving an order out of STORNIERT. Cancelling
restocks the goods and refunds the payment; reopening did neither in
reverse, and the next cancellation passed the "not already cancelled"
claim again and restocked a second time (the refund was not repeated
because the payment was already REFUNDED, so only the stock showed it).

STORNIERT is now a final state:
- isOrderStatusChangeAllowed() in lib/inventory.ts next to the other
  cancel rules, with tests
- updateOrderStatusAction rejects the change up front with a clear
  message and moves non-cancel statuses with an atomic
  "status <> STORNIERT" update, so a cancellation from a second tab
  cannot be undone in between
- the order list and detail page no longer offer the status select for
  cancelled orders

Existing stock that was restocked twice has to be corrected by hand.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

src/app/admin/bestellungen/page.tsx

@@ -139,6 +139,8 @@ export default async function AdminOrdersPage(props: PageProps<"/admin/bestellun
                 <td className="p-4 whitespace-nowrap tabular-nums">{formatPrice(order.totalCents, order.currency)}</td>
                 <td className="p-4">
                   <OrderStatusBadge status={order.status} label={statusLabels[order.status] ?? order.status} />
+                  {/* Storniert ist ein Endzustand (isOrderStatusChangeAllowed) — keine Auswahl anbieten, die der Server ablehnt. */}
+                  {order.status !== "STORNIERT" ? (
                   <form action={updateOrderStatusAction} className="mt-2 flex items-center gap-2">
                     <input type="hidden" name="orderId" value={order.id} />
                     <select
@@ -160,6 +162,7 @@ export default async function AdminOrdersPage(props: PageProps<"/admin/bestellun
                       {t.adminOrdersPage.save}
                     </button>
                   </form>
+                  ) : null}
                 </td>
                 <td className="p-4">
                   {order.fulfillmentMethod === "VERSAND" ? t.adminOrdersPage.shipping : t.adminOrdersPage.pickup}