trucking: pass-through fee disclosure + state fulfillment status machine

Item 2 of the trucking state-authorization plan.

- compliance-orders.ts: populate gov_fee_label for every state-trucking
  service so the variable, billed-at-cost government charges (apportioned
  IRP, IFTA decals, NY HUT, CT HUF, weight-distance, CA MCP+CARB, OS/OW
  permits, bundle) are disclosed at checkout. price_cents stays the flat
  service fee; gov fees pass through at cost.
- migration 086: compliance_orders.fulfillment_status state machine
  (authorization_required -> authorization_signed -> awaiting_customer_
  delegation -> awaiting_secure_credentials -> awaiting_government_fee_
  approval -> awaiting_insurance_filing -> ready_to_file ->
  filed_waiting_state -> completed) + fulfillment_status_at
- state_trucking.py: FULFILLMENT_* constants + _set_fulfillment_status();
  gate sets authorization_required on pause, authorization_signed on
  resume, ready_to_file once the filing todo is queued
- TruckingValueNotice.astro: 'What's included & what's billed at cost'
  disclosure with the authorization/delegation explanation

scripts/workers/services/state_trucking.py

@@ -32,6 +32,19 @@ from datetime import datetime
 
 LOG = logging.getLogger("workers.services.state_trucking")
 
+# State motor carrier fulfillment lifecycle (compliance_orders.fulfillment_status,
+# migration 086). These let ops and the customer portal see exactly where a state
+# filing is, independent of payment_status.
+FULFILLMENT_AUTHORIZATION_REQUIRED = "authorization_required"
+FULFILLMENT_AUTHORIZATION_SIGNED = "authorization_signed"
+FULFILLMENT_AWAITING_DELEGATION = "awaiting_customer_delegation"
+FULFILLMENT_AWAITING_CREDENTIALS = "awaiting_secure_credentials"
+FULFILLMENT_AWAITING_FEE_APPROVAL = "awaiting_government_fee_approval"
+FULFILLMENT_AWAITING_INSURANCE = "awaiting_insurance_filing"
+FULFILLMENT_READY_TO_FILE = "ready_to_file"
+FULFILLMENT_FILED_WAITING_STATE = "filed_waiting_state"
+FULFILLMENT_COMPLETED = "completed"
+
 # Map service slugs to human-readable names and filing instructions
 SERVICE_INFO = {
     "irp-registration": {
@@ -258,6 +271,7 @@ class StateTruckingHandler:
                 signer_title=str(intake.get("signer_title", "")),
             )
             if requested:
+                self._set_fulfillment_status(order_number, FULFILLMENT_AUTHORIZATION_REQUIRED)
                 LOG.info(
                     "[%s] Authorization requested — pipeline PAUSED pending signature",
                     order_number,
@@ -271,6 +285,7 @@ class StateTruckingHandler:
             )
         else:
             signed_auth_key = self._signed_authorization_key(order_number)
+            self._set_fulfillment_status(order_number, FULFILLMENT_AUTHORIZATION_SIGNED)
             LOG.info("[%s] Authorization signed (%s) — proceeding to filing", order_number, signed_auth_key)
 
         # Slug-specific intake fields collected by StateTruckingIntakeStep.
@@ -343,6 +358,8 @@ class StateTruckingHandler:
             finally:
                 conn.close()
             LOG.info("[%s] Admin todo created for %s", order_number, service_name)
+            # Authorization is in hand and the filing task is queued for ops.
+            self._set_fulfillment_status(order_number, FULFILLMENT_READY_TO_FILE)
         except Exception as exc:
             LOG.error("[%s] Failed to create admin todo: %s", order_number, exc)
 
@@ -606,6 +623,30 @@ class StateTruckingHandler:
 
         return True
 
+    def _set_fulfillment_status(self, order_number: str, status: str) -> None:
+        """Advance compliance_orders.fulfillment_status (best-effort).
+
+        ``status`` must be one of the FULFILLMENT_* constants. Non-fatal: a
+        failure here never blocks the filing pipeline.
+        """
+        try:
+            import psycopg2
+            conn = psycopg2.connect(os.environ.get("DATABASE_URL", ""))
+            try:
+                with conn.cursor() as cur:
+                    cur.execute(
+                        """UPDATE compliance_orders
+                           SET fulfillment_status = %s, fulfillment_status_at = NOW(),
+                               updated_at = NOW()
+                           WHERE order_number = %s""",
+                        (status, order_number),
+                    )
+                conn.commit()
+            finally:
+                conn.close()
+        except Exception as exc:
+            LOG.warning("[%s] Could not set fulfillment_status=%s: %s", order_number, status, exc)
+
     def _authorization_status(self, order_number: str) -> str | None:
         """Return the current authorization esign status: 'signed', 'pending', or None."""
         try: