feat(finance/proto): add MB batch costing suite, workflow RPCs, and recipe lock

buf.lock

@@ -2,8 +2,8 @@
 version: v2
 deps:
   - name: buf.build/bufbuild/protovalidate
-    commit: 50325440f8f24053b047484a6bf60b76
-    digest: b5:74cb6f5c0853c3c10aafc701614194bbd63326bdb8ef4068214454b8894b03ba4113e04b3a33a8321cdf05336e37db4dc14a5e2495db8462566914f36086ba31
+    commit: 435963d1631043e694e56e6bcc3c79c3
+    digest: b5:f4ea07ad2dd94bd7243562f9908b9fb104feef8076040c89d9f7c1dedc074de4d4ce2b997686ef4400f3eccb765a7cfc20ed4acdd70b9a3699351245c61dba97
   - name: buf.build/googleapis/googleapis
     commit: c17df5b2beca46928cc87d5656bd5343
     digest: b5:648a01e0170d4512dea7d564016165decd1ed6e34bef79fe54753e51ad7e27545709ad9157d7551270147d551155c595a2fb0bf5bb33b1c83040ddbce915c604

finance/v1/cost_product_master.proto

@@ -35,6 +35,8 @@ message CostProductMaster {
   string flex_01 = 18;
   string flex_02 = 19;
   string flex_03 = 20;
+  string source = 21; // origin marker, e.g. "MB_RECIPE" when auto-generated; empty if manually created
+  bool is_locked = 22; // true blocks manual edits to route/params; escape hatch via UnlockCostProductMaster
 }
 
 // =============================================================================
@@ -141,6 +143,25 @@ message DeactivateCostProductMasterResponse {
   common.v1.BaseResponse base = 1;
 }
 
+// =============================================================================
+// Unlock — finance-admin escape hatch for MB-recipe-locked products. Clears
+// cpm_is_locked for 24h and records an mst_mb_lock_log audit row; the product
+// auto-relocks after the window (enforced server-side, not by this RPC).
+// =============================================================================
+
+message UnlockCostProductMasterRequest {
+  int64 product_sys_id = 1 [(buf.validate.field).int64.gte = 1];
+  string reason = 2 [(buf.validate.field).string = {
+    min_len: 1
+    max_len: 500
+  }];
+}
+
+message UnlockCostProductMasterResponse {
+  common.v1.BaseResponse base = 1;
+  CostProductMaster data = 2;
+}
+
 // =============================================================================
 // List — paginated browse with rich filters.
 // =============================================================================
@@ -269,6 +290,12 @@ service CostProductMasterService {
   rpc DeactivateCostProductMaster(DeactivateCostProductMasterRequest) returns (DeactivateCostProductMasterResponse) {
     option (google.api.http) = {delete: "/api/v1/finance/cost-product-master/{product_sys_id}"};
   }
+  rpc UnlockCostProductMaster(UnlockCostProductMasterRequest) returns (UnlockCostProductMasterResponse) {
+    option (google.api.http) = {
+      post: "/api/v1/finance/cost-product-master/{product_sys_id}/unlock"
+      body: "*"
+    };
+  }
   rpc ListCostProductMasters(ListCostProductMastersRequest) returns (ListCostProductMastersResponse) {
     option (google.api.http) = {get: "/api/v1/finance/cost-product-master"};
   }