feat(api): add staff order booking contract and shift timeline alias

backend/command-api/test/mobile-routes.test.js

@@ -65,6 +65,14 @@ function createMobileHandlers() {
       invoiceId: payload.invoiceId,
       status: 'APPROVED',
     }),
+    bookOrder: async (_actor, payload) => ({
+      bookingId: 'booking-1',
+      orderId: payload.orderId,
+      roleId: payload.roleId,
+      assignedShiftCount: 3,
+      status: 'PENDING',
+      assignedShifts: [],
+    }),
     registerClientPushToken: async (_actor, payload) => ({
       tokenId: 'push-token-client-1',
       platform: payload.platform,
@@ -410,6 +418,23 @@ test('POST /commands/staff/shifts/:shiftId/submit-for-approval injects shift id
   assert.equal(res.body.submitted, true);
 });
 
+test('POST /commands/staff/orders/:orderId/book injects order id from params', async () => {
+  const app = createApp({ mobileCommandHandlers: createMobileHandlers() });
+  const res = await request(app)
+    .post('/commands/staff/orders/88888888-8888-4888-8888-888888888888/book')
+    .set('Authorization', 'Bearer test-token')
+    .set('Idempotency-Key', 'staff-order-book-1')
+    .send({
+      roleId: '99999999-9999-4999-8999-999999999999',
+    });
+
+  assert.equal(res.status, 200);
+  assert.equal(res.body.orderId, '88888888-8888-4888-8888-888888888888');
+  assert.equal(res.body.roleId, '99999999-9999-4999-8999-999999999999');
+  assert.equal(res.body.assignedShiftCount, 3);
+  assert.equal(res.body.status, 'PENDING');
+});
+
 test('POST /commands/client/coverage/swap-requests/:swapRequestId/resolve injects swap request id from params', async () => {
   const app = createApp({ mobileCommandHandlers: createMobileHandlers() });
   const res = await request(app)