feat(api): modo solo lectura (SAPB1_SL_READ_ONLY) que rechaza toda escritura hacia el Service Layer

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

apps/api/src/sl/sl-proxy.service.spec.ts

@@ -1,6 +1,7 @@
 import { ForbiddenException } from '@nestjs/common';
 import { vi } from 'vitest';
 import type { AuditService } from '../audit/audit.service.js';
+import type { AppConfigService } from '../config/app-config.service.js';
 import type { AuthUser } from '../auth/auth.types.js';
 import type { PermissionsService } from '../permissions/permissions.service.js';
 import type { SapClientService } from '../sap/sap-client.service.js';
@@ -114,3 +115,39 @@ describe('SlProxyService: auditoría', () => {
     });
   });
 });
+
+describe('SlProxyService: modo solo lectura', () => {
+  const make = (readOnly: boolean) => {
+    const request = vi.fn(async () => ({ data: { value: [] } }));
+    const record = vi.fn(async () => undefined);
+    const service = new SlProxyService(
+      { request } as unknown as SapClientService,
+      { getPaths: async () => ['*'] } as unknown as PermissionsService,
+      { record } as unknown as AuditService,
+      { get: (k: string) => (k === 'SAPB1_SL_READ_ONLY' ? readOnly : undefined) } as unknown as AppConfigService,
+    );
+    return { service, request, record };
+  };
+
+  it('rechaza crear, modificar y las acciones sin llegar a SAP, y lo audita', async () => {
+    const { service, request, record } = make(true);
+    await expect(service.create(user, 'Orders', { CardCode: 'C1' }, {}, '10.0.0.5')).rejects.toThrow('solo lectura');
+    await expect(service.update(user, 'Orders', '1', { Comments: 'x' }, {}, '10.0.0.5')).rejects.toThrow('solo lectura');
+    await expect(service.action(user, 'IncomingPayments', '1', 'Cancel', '10.0.0.5')).rejects.toThrow('solo lectura');
+    expect(request).not.toHaveBeenCalled();
+    expect(record).toHaveBeenCalledWith(expect.objectContaining({ action: 'sl_denied', outcome: 'denied' }));
+  });
+
+  it('las consultas y las acciones de solo consulta (series) siguen funcionando', async () => {
+    const { service, request } = make(true);
+    await service.list(user, 'Orders', {}, {});
+    await service.create(user, 'SeriesService_GetDocumentSeries', { DocumentTypeParams: { Document: '30' } }, {}, '10.0.0.5');
+    expect(request).toHaveBeenCalledTimes(2);
+  });
+
+  it('sin el modo solo lectura todo sigue igual', async () => {
+    const { service, request } = make(false);
+    await service.create(user, 'Orders', { CardCode: 'C1' }, {}, '10.0.0.5');
+    expect(request).toHaveBeenCalledTimes(1);
+  });
+});