Fix order cancellation by allowing cancelled in the database status constraint.

The cancel API returned 500 because ck_orders_status did not include cancelled.
Adds Flyway V9 and an E2E test for cancelling a pending order from /orders.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/src/main/resources/db/migration/V9__add_cancelled_order_status.sql

@@ -0,0 +1,14 @@
+ALTER TABLE orders DROP CONSTRAINT ck_orders_status;
+
+ALTER TABLE orders
+    ADD CONSTRAINT ck_orders_status CHECK (
+        status IN (
+            'pending_payment',
+            'paid',
+            'processing',
+            'sent',
+            'delivered',
+            'failed',
+            'cancelled'
+        )
+    );

frontend/e2e/order-history.spec.ts

@@ -91,4 +91,38 @@ test.describe('Order history', () => {
     const trackingLink2 = page.getByRole('link', { name: 'PN987654321' })
     await expect(trackingLink2).toBeVisible()
   })
+
+  test('can cancel pending order', async ({ page }) => {
+    const plate = 'CAN999'
+
+    await page.goto('/logga-in')
+    await page.getByLabel('E-postadress').fill('test@bilhej.se')
+    await page.getByLabel('Lösenord').fill('test1234')
+    await page.getByRole('button', { name: 'Logga in' }).click()
+    await page.waitForURL('/')
+
+    await page.goto(`/compose?plate=${plate}`)
+    await page.getByLabel('Ditt meddelande').fill('E2E-test: ska kunna avbrytas.')
+    await page.getByRole('button', { name: 'Fortsätt till betalning' }).click()
+    await expect(page).toHaveURL(/\/betalning\//)
+
+    await page.goto('/orders')
+
+    const pendingCard = page.locator('.orders__card', { hasText: plate })
+    await expect(pendingCard.getByText('Väntar på betalning')).toBeVisible()
+    await expect(
+      pendingCard.getByRole('link', { name: 'Betala 49 kr' }),
+    ).toBeVisible()
+
+    page.once('dialog', (dialog) => dialog.accept())
+    await pendingCard.getByRole('button', { name: 'Avbryt beställning' }).click()
+
+    await expect(pendingCard.getByText('Avbruten')).toBeVisible()
+    await expect(
+      pendingCard.getByRole('link', { name: 'Betala 49 kr' }),
+    ).not.toBeVisible()
+    await expect(
+      pendingCard.getByRole('button', { name: 'Avbryt beställning' }),
+    ).not.toBeVisible()
+  })
 })