docs(api): settle whether a create may name a chart the writer has no relationship with (#330)

[aupyay]

Summary

• The PATCH half of May a write name a chart the writer has no relationship with? #330 was fixed in fix(api): gate the chart a patch names, not only the row it found #421 (gate on the row as patched). This settles the CREATE half, which the issue left as an explicit open question.
• Decision: create stays ungated on the chart it names, "yes, as triage needs" - the inbox-fax triage workflow (POST /documents/:id/file) already relies on naming a chart with no prior relationship, and a create grants no read back on its own.
• Recorded the decision as a comment at the omission site in crud.ts, and added a test in routes.orders.test.ts naming the decision so it isn't mistaken for an oversight later.

Test plan

• pnpm --filter api lint
• pnpm --filter api type-check
• pnpm --filter api test (4171 passed, 14 skipped)
• pnpm run format:check
• pnpm verify
• Mutation check: temporarily added a guardChart call to CREATE, new test failed as expected (404 vs 201), reverted

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

[ankit-yc]

Reviewed exact head a7cea5b. The test locks the deliberate create behavior from #330 at the generated seam, and the rationale matches the documented fax-triage workflow. Local API lint, type-check, full test suite, build, formatting, and diff check passed. The remaining CI failure is the repeated SonarCloud JRE-metadata HTTP 403 before analysis, also present on the prior API PR.