feat(server): add PATCH/DELETE /attachment/box mirroring product box ops

Co-Authored-By: Claude <noreply@anthropic.com>

tests/test_attachment_boxing.py

@@ -149,3 +149,80 @@ def test_attachment_box_completion(client: TestClient, db: Session):
         "/CargoTrace/attachment/status", params={"zongpai_no": "26BW0011"}
     ).json()
     assert status["all_complete"] is True
+
+
+def test_attachment_box_update_quantity(client: TestClient, db: Session):
+    cert_id, _ = _seed(db)
+    created = client.post(
+        "/CargoTrace/attachment/box",
+        json={
+            "zongpai_no": "26BW0011",
+            "category_id": cert_id,
+            "box_no": 941,
+            "quantity": 30,
+        },
+    ).json()
+    item_id = created["box_item_id"]
+    updated = client.patch(
+        f"/CargoTrace/attachment/box/{item_id}",
+        json={"box_no": 941, "quantity": 25},
+    )
+    assert updated.status_code == 200
+    assert updated.json()["quantity"] == 25
+
+
+def test_attachment_box_update_rejects_over_expected(client: TestClient, db: Session):
+    cert_id, _ = _seed(db)
+    client.put(
+        "/CargoTrace/attachment/config",
+        json={
+            "zongpai_no": "26BW0011",
+            "determination": "has",
+            "items": [{"category_id": cert_id, "expected_qty": 80}],
+        },
+    )
+    created = client.post(
+        "/CargoTrace/attachment/box",
+        json={
+            "zongpai_no": "26BW0011",
+            "category_id": cert_id,
+            "box_no": 942,
+            "quantity": 70,
+        },
+    ).json()
+    over = client.patch(
+        f"/CargoTrace/attachment/box/{created['box_item_id']}",
+        json={"box_no": 942, "quantity": 81},
+    )
+    assert over.status_code == 400
+    assert over.json()["error_code"] == "INVALID_QUANTITY"
+
+
+def test_attachment_box_delete_cleans_empty_box(client: TestClient, db: Session):
+    cert_id, _ = _seed(db)
+    created = client.post(
+        "/CargoTrace/attachment/box",
+        json={
+            "zongpai_no": "26BW0011",
+            "category_id": cert_id,
+            "box_no": 943,
+            "quantity": 10,
+        },
+    ).json()
+    item_id = created["box_item_id"]
+    deleted = client.delete(f"/CargoTrace/attachment/box/{item_id}")
+    assert deleted.status_code == 200
+    assert deleted.json() == {"box_item_id": item_id, "deleted": True}
+
+    # Box was attachment-only; deleting it should also remove the empty box
+    # so the same box_no can be recreated for a different总排号.
+    recreated = client.post(
+        "/CargoTrace/attachment/box",
+        json={
+            "zongpai_no": "26BW0012",
+            "category_id": cert_id,
+            "box_no": 943,
+            "quantity": 5,
+        },
+    )
+    assert recreated.status_code == 200