F13: Destructive-action guards + prefill-failure overwrite fix (#59)

[mforce]

Closes #59. SPA-only, 3 files. Follow-up to the mis-deplete incident that motivated #57.

What

• Confirm dialogs on every one-way action: daily-entry Save & submit (creates lots), sales Confirm order (allocates stock — void is F14: Void confirmed sales order — return allocated stock #60) and Cancel draft, flock deplete/archive. Reversible actions stay one-click. Plain window.confirm for now; styled dialogs belong to the UI design revamp — distinctive visual identity #52 revamp.
• Prefill-failure guard: the daily-entry edit prefill was best-effort — a failed lookup rendered zeros for a day that has data, and saving would overwrite the draft. Failure now blocks both save buttons with an explanatory error + retry; saving unblocks only after a successful prefill.

Verification (chromium, real stack, both dialog paths each)

• Deplete: dismiss → stays Active; accept → Depleted.
• Save & submit: dismiss → nothing submitted; accept → Submitted with lots.
• Cancel draft: dismiss → draft panel intact; accept → cancelled.
• Prefill: aborted the lookup via route interception → banner + disabled saves; retry after restoring → unblocked.
• Confirm-order dialog: gate code identical to the three verified above; not driven live because a confirmable order needs stock seeding (dialog fires before any API call, so the dismiss path is the same logic).

[mforce]

Review round: codex + pi

#	Source	Severity	Finding	Action
1	codex + pi	P1/High	Retry cleared prefillFailed optimistically before the lookup resolved — a quick save in that window could overwrite the draft, the exact bug the guard closes	Fixed — prefillPending state; saves blocked from fetch start until success; clear only in .then (9f906e2)
2	pi	Medium	Retry recovery with no existing entry re-zeroed the form, wiping values typed while the banner was up	Fixed — same-target retry recovery preserves the form; normal flock/date changes still reset (9f906e2)
3	pi	Medium	Sales confirms ran inside run() — all buttons flashed disabled while the user was deciding	Fixed — confirms hoisted above run(), matching the Flocks pattern (9f906e2)
4	codex	P2	Cancel dialog claimed "line items are discarded" — cancel is a status change; lines are kept, order becomes read-only	Fixed — reworded (9f906e2)
5	pi	Low	window.confirm silently returns false in sandboxed/iframe contexts	Accepted — noted; styled dialogs come with #52
6	pi	Low	Confirm strings hardcoded (i18n)	Deferred — #45's string-extraction sweep will catch these with the rest of the SPA
7	pi	Low	Deplete dialog's "backfill still works" claim should track the domain	Verified — matches CanRecordProductionOn semantics shipped in #48/#55

Re-verified after fixes: retry while the network is still broken stays blocked; typed values survive a retry recovery; a normal date change still resets the form; recovery unblocks saving.