fix(measure): filtro stazione anche su barcode, avvio sequenza e task_execute (#24)

_recipe_allowed_at_station() riusa get_station_recipes() (stessa fonte di
/measure/select) per lookup_barcode, start_sequence e task_execute: prima
solo l'elenco filtrava, il barcode e i link diretti lasciavano misurare
ricette non assegnate alla stazione. Ricetta non assegnata -> abort(403)
con messaggio "ricetta non assegnata a questa stazione" (pagine, come già
fa role_required) o JSON 403 (lookup-barcode). Aggiornati i test esistenti
che ora richiedono get_station_recipes/STATION_CODE mockati.
Backend (ruoli sui run, StationRecipeAssignment su open_run) resta al
lotto A1.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/frontend/flask_app/tests/test_template_js_syntax.py

@@ -227,7 +227,7 @@ def mock_measure_api():
         yield mock
 
 
-def test_task_execute_inline_js_is_valid(logged_in_client, mock_measure_api):
+def test_task_execute_inline_js_is_valid(logged_in_client, mock_measure_api, monkeypatch):
     """The measurement screen carries the most inline JS in the app.
 
     It drives the numpad, the caliper burst detection, the supervisor modal and -
@@ -235,6 +235,9 @@ def test_task_execute_inline_js_is_valid(logged_in_client, mock_measure_api):
     here kills every binding on the screen the operator actually works in.
     """
     _force_italian(logged_in_client)
+    # STATION_CODE defaults to unset in the test env, so it has to be forced
+    # for task_execute()'s station-assignment check (#24).
+    monkeypatch.setattr("blueprints.measure.Config.STATION_CODE", "ST-TEST")
     task = {
         "id": 11,
         "recipe_id": 3,
@@ -250,6 +253,8 @@ def test_task_execute_inline_js_is_valid(logged_in_client, mock_measure_api):
             "unit": "mm",
         }],
     }
+    # task_execute() only renders a recipe assigned to this station (#24).
+    mock_measure_api.get_station_recipes.return_value = [{"id": 3}]
     mock_measure_api.get.side_effect = [
         task,                                        # /api/tasks/11
         [{"id": 11, "order_index": 0}],              # /api/recipes/3/tasks