feat: require customer approval before mark paid/deliver

- Disable checkboxes, payment ref input, and submit button in admin UI when customer has not approved.
- Add server-side guard in mark_paid_deliver action.

app.py

@@ -859,6 +859,10 @@ def admin_request(rid):
 
         elif action == 'mark_paid_deliver':
             # Finalize: record Square payment ref, attach approved MP3s, email customer.
+            if req.get('customer_approved', 'none') == 'none':
+                flash('Customer must approve a version before you can mark paid or deliver.', 'error')
+                return redirect(url_for('admin_request', rid=rid))
+
             payment_ref = request.form.get('square_payment_ref', '').strip()
             if not payment_ref:
                 flash('Square payment reference is required.', 'error')