#11288 Ancillary item service + GraphQL layers

[ria8651]

Fixes #11288

Stacked on #11332 — please merge that first. #11289 and #11290 will follow stacked on this.

👩🏻‍💻 What does this PR do?

Adds the service and GraphQL layers on top of the schema from #11287, exposing the ancillary-item CRUD surface the frontend will drive.

Service layer (server/service/src/item/ancillary_item/):

• upsert_ancillary_item — handles both insert and update; validates central-only authz, item_quantity > 0 and ancillary_quantity > 0, both item_link_id FKs, duplicate (principal, ancillary) pairs, and reuses validate_ancillary_item_link from Ancillary items: schema + sync for ancillary_item table #11287 for self-link / cycle / max-depth.
• delete_ancillary_item — soft delete with central-only guard.
• get_ancillary_items — paginated list query.
• Wired into ItemServiceTrait alongside existing bundled-item / item-variant CRUD.

GraphQL layer (new graphql_ancillary_item crate, matches the bundled_item pattern):

• Mutations: centralServer.ancillaryItem.upsertAncillaryItem and .deleteAncillaryItem.
• Input type uses itemQuantity / ancillaryQuantity directly (not a derived ratio) so the client sends the user's original x:y.
• AncillaryItemNode type: exposes id, itemQuantity, ancillaryQuantity, itemLinkId, ancillaryItemLinkId, plus nested item / ancillaryItem resolved via the existing ItemLoader.
• ItemNode.ancillaryItems and ItemNode.ancillaryFor fields: backed by two new DataLoaders so the frontend can fetch an item's ancillary links (as principal or as ancillary) in one round-trip.

Tests: one consolidated service-layer test covering CRUD + every error variant (central-only, FK, ratio, self-link, cycle, duplicate, update-excludes-self), plus two GraphQL mutation tests covering success + error-bucket mapping.

💌 Any notes for the reviewer?

Known limitation (same as bundled_item): the loaders treat item_link_id as item_id, which is the common case for newly-created items but breaks for items that have been merged (multiple link IDs pointing at the same item). Documented inline at graphql/core/src/loader/ancillary_item.rs. Follow-up if/when it becomes a real issue.

Service-layer central-only check is belt-and-suspenders with the GraphQL central_server wrapper — both reject non-central mutations, the service-layer variant just produces a cleaner NotCentralServer service error for future callers (e.g. sync-triggered paths).

Tests use a process-wide central-server flag. The service test consolidates all sub-cases into a single #[actix_rt::test] to avoid races with cargo's parallel runner since other test modules set the same flag. Covered inline at service/src/item/ancillary_item/test/mod.rs.

No divergence from the issue scope. All four items in the issue's Scope section (queries, mutations, validation, tests) implemented.

🧪 Testing

Prerequisite: #11287 merged (or running this branch which includes it).

• Run cargo test --package service ancillary_item — expect 1 test (consolidated, covers all scenarios).
• Run cargo test --package graphql_ancillary_item — expect 2 tests (upsert + delete happy/error paths).
• Via GraphQL (on an oMS central server):
  • upsertAncillaryItem with valid input → AncillaryItemNode with both quantities returned.
  • Repeat with same (itemLinkId, ancillaryItemLinkId) pair but different id → DuplicateAncillaryItem (BadUserInput).
  • Same but itemLinkId == ancillaryItemLinkId → CanNotLinkItemWithItself (BadUserInput).
  • Create A→B, then try B→A → CycleDetected.
  • itemQuantity: 0 → RatioMustBePositive.
  • deleteAncillaryItem → DeleteResponse on success; check DB: deleted_datetime populated.
• On a remote (non-central) site: same mutations return Forbidden (via the central_server wrapper).
• Query ItemNode.ancillaryItems and ancillaryFor for a linked item → returns the expected AncillaryItemNodes with nested item / ancillaryItem.

Note that this testing with manual graphql queries can be skipped and just wait for the next two PRs which will add UI for this.

📃 Documentation

• Part of an epic: documentation will be completed for the feature as a whole (Ancillary Items for ordering #11232)
• No documentation required: no user facing changes or a bug fix which isn't a change in behaviour
• These areas should be updated or checked:
  1.
  2.

📃 Reviewer Checklist

The PR Reviewer(s) should fill out this section before approving the PR

Breaking Changes

• No Breaking Changes in the Graphql API
• Technically some Breaking Changes but not expected to impact any integrations

Issue Review

• All requirements in original issue have been covered
• A follow up issue(s) have been created to cover additional requirements

Tests Pass

• Postgres
• SQLite
• Frontend

[github-actions]

Test report (sqlite)

1 007 tests   1 006 ✅  7m 31s ⏱️
   24 suites      0 💤
    1 files        1 ❌

For more details on these failures, see this check.

Results for commit e352c74.

♻️ This comment has been updated with latest results.

[github-actions]

Test report (postgres)

1 008 tests   1 007 ✅  49m 55s ⏱️
   24 suites      0 💤
    1 files        1 ❌

For more details on these failures, see this check.

Results for commit e352c74.

♻️ This comment has been updated with latest results.

[jmbrunskill]

Looks good, lets just remove the link_id from the graphql response...

[ria8651]

Updated with repository layer item link changes. Should handle merging properly now. Addressed other comments too.

[jmbrunskill]

Updates look fine, feel free to merge when tests pass