fix(orders): status change AJAX feedback and destructive action confirmation (#98)

[b3lz3but]

Summary

• Error feedback: API error messages now display inline in the modal (red banner) instead of a generic alert(). The response JSON is parsed on both success and error HTTP statuses.
• Destructive confirmation: Selecting "Cancelled" or "Failed" shows a type-to-confirm dialog. The submit button stays disabled until the user types the confirmation word (CANCEL or FAILED).
• Success flow: Modal closes, success toast appears, page reloads after 600ms to reflect new status.

Closes #98

Test plan

• All pre-commit hooks pass (DCO, template syntax, i18n)
• CI: platform, portal, integration, DCO check workflows
• Manual: test status change success flow (modal closes, toast, page refresh)
• Manual: test status change error flow (error message in modal)
• Manual: test destructive confirmation (cancelled/failed require typing)
• Manual: test closing modal resets confirmation state

Generated with Claude Code

[b3lz3but]

Changes

Error handling fix (Audit #5):

• Previously: HTTP errors threw before parsing JSON, falling through to a generic alert(). The modal stayed open with no feedback.
• Now: Response JSON is always parsed. Errors display inline in a red banner (#statusError) inside the modal with the actual API message.

Destructive confirmation (Audit #16):

• All cancelled and failed <option> elements now have data-destructive="true"
• Selecting a destructive option shows a type-to-confirm input ("Type CANCEL to confirm" / "Type FAILED to confirm")
• Submit button is disabled until the confirmation word matches
• Closing the modal resets confirmation state

No Python changes — template-only fix (1 file, ~80 lines net).

@mostlyvirtual requesting your review.