R5.7 Reverse Sync (prod) — Odoo backoffice edits → cafe.orders

7/7 prod-test steps green.

One real drift caught on first run. Odoo order #94 (Cafe order_number Order 00123-4949-357252, rang 2026-04-18) had been cancelled in Odoo backoffice but cafe.orders still showed it as paid. Reverse sync flipped it to refunded / refund_reason='Cancelled in Odoo' / refunded_at=2026-04-18T15:54:20Z. Working as designed — exactly the kind of silent drift R5.7 was built to catch.
Three delta types in scope: (a) operator-side refund — Odoo's refunded_order_id points at the original; flip to refunded + stamp odoo_refund_synced_at so the forward worker doesn't try to push our own. (b) Cancel-in-Odoo — state='cancel' → cafe refunded. (c) Customer attach/change — update customerName + odooPartnerId.
Out of scope (deliberately): line edits, total/payment changes. Soft-warning logged on amount drift, never overwrites the cafe ledger. Risk of clobbering legitimate Cafe-side state outweighed the value of mirroring rare line edits.
Watermark on tenant_config. Per-tenant odoo_reverse_sync_watermark column; advances to MAX(write_date) of the batch on success. NULL = first run; bounded by the join on odoo_order_id against cafe.orders + limit=500 per fetch.
Cron schedule: */15 * * * * on the existing nix-cafe-cron-trigger Worker. Joins forward-sync (* * * * *), daily report (15:00 UTC), and R2 GC (18:30 UTC).