PASS 01 GET /bills/new: form, token, 11 services, 3 outlets
PASS 02 POST without the token is refused (400)
PASS 03 POST with a wrong token is refused (400)
PASS 04 four field errors, one summary, status 400
PASS 05 typed markup comes back escaped, never as markup
PASS 06 a quote cannot break out of the value attribute
PASS 07 Calculate price: 2,4 kg express quoted, nothing saved
PASS 08 Save bill: a redirect to /bills/B2954 (Post/Redirect/Get)
PASS 09 the bill page shows the flash and the server's price, not the posted one
PASS 10 reload: the flash is gone, nothing is created twice
PASS 11 the same rack again is refused
PASS 12 2.1 kg of curtains: 3 kg x Rp 15.000 = Rp 45.000 as B2955
PASS 13 upload without the token is refused (400)
PASS 14 upload with no file: 'Choose a photo'
PASS 15 HTML named receipt.png is refused by its first bytes
PASS 16 a 2.5 MB photo is refused
PASS 17 a real PNG is stored under a name the server chose
PASS 18 the photo comes back byte for byte, image/png, nosniff
PASS 19 a path outside the upload folder is not served
      database: ('S0002', 3, 36000, 'queued', 'E0004', '2026-09-30 21:00:00') [('queued', '2026-09-30 21:00:00')]
PASS 20 no such bill: 404 ; the database holds exactly what the server computed
flask: 20 passed, 0 failed
