Cross-instance API: create pending quote from source inspection

Objective

• Provide a backend API that creates a pending quote in a target company from a source inspection, carrying property and contact data without cross-company ID leakage.
• Enforce dual-membership and a dedicated permission so only authorized users can hand off jobs across instances.

Background

• Parent epic: cross-instance quote from existing job (workorder entry point).
• Quotes are created per company via createQuoteWithCharges in attik-backend/src/util/functions/quote/createQuoteWithCharges.ts with _companyId on quoteSchema.
• No existing route creates a quote in company B from an inspection in company A.
• Cross-instance action flow copy (copyActionFlowToCompany in attik-backend/src/util/functions/actionFlows/copyActionFlowToCompany.ts, endpoints in attik-backend/src/routes/flow.ts) is the closest pattern for targetCompanyId + allowed-company checks.

Scope

Backend

• New endpoint (e.g. under instance-management or inspection/:id/...) accepting source inspection id + targetCompanyId; validate user membership in both companies and new permission.
• Load populated source inspection (property, people, charges as reference); build quote payload for target _companyId.
• Create quote with status: 'pending' via createQuoteWithCharges (or equivalent transaction used by attik-backend/src/routes/quote.ts).
• Contacts: match-or-create in target company (patterns similar to findSpectoraContactMatches in attik-backend/src/util/functions/spectora/findSpectoraContactMatches.ts); map people[] with destination _contactId / _roleId only.
• Property: copy address/property fields onto destination quote property.
• Provenance: decision needed — optional fields on quote for _sourceInspectionId, _sourceCompanyId, created-by metadata for audit.
• Exclude from copy: wcLeadId, _hubspotDealId, _finalInspectionId, source charge/service Mongo IDs, source inspector IDs.
• Services/charges: initial create may omit charges or include empty charge list until service-mapping child lands; decision needed on minimum viable payload.
• Return created quote id/slug and target company id for frontend navigation.

Frontend

• None in this child (workorder UI is a separate child); expose types/server action contract as needed for the UI child.

Out of scope

• Workorder modal UX.
• Contact role mapping UI (separate child).
• Service mapping, report attachments.
• Creating unconfirmed inspections in destination.

References

• attik-backend/src/util/functions/quote/createQuoteWithCharges.ts
• attik-backend/src/routes/quote.ts
• attik-backend/src/models/quoteSchema.ts
• attik-backend/src/routes/protectedRouteBarrel.ts (/instance-management)
• attik-backend/src/routes/flow.ts (cross-company copy guards)