Changes

registration: keep the manual-review promise — gate ERP onboarding on needs_manual_approval

HANDOFF §4 (ERP repo, reference/blut24/HANDOFF.md). needs_manual_approval gated
nothing: couriers and no-domain clinics — exactly the registrations nothing
could verify — were auto-onboarded into iDempiere with live credentials mailed,
while form, confirmation mail and welcome mail promised a manual review.
confirm.post.ts now skips onboarding for them and records erp_status
'manual-approval'; the operator provisions them by hand. Verified and test
registrations stay fully automatic.

Copy made truthful: the test-domain notice no longer claims "marked for manual
approval" (test domains auto-activate; they are marked internally as test
registrations), and the manual-review texts are courier-neutral instead of
explaining a clinic-only domain lookup.

alreadyConfirmed now returns credentialsSent, read from the stored ERP payload
(setErpResult persists it).

README: the ERP auth section described a Bearer scheme the code never uses —
the token travels as the logship_it cookie, and the ERP's send-credentials
route is now gated on exact equality with the instance's IDEMPIERETOKEN, so
ERP_SERVICE_TOKEN must be exactly that value.

test-registration.mjs: courier confirm asserts needsManualApproval,
credentialsSent=false and erp_status 'manual-approval' (83/83 green).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 (commit: 49f3d63)