feat: add Request.purchaseOrderId (nullable FK)

prisma/schema.prisma

@@ -26,21 +26,30 @@ enum RequestType {
 }
 
 model Request {
-  id         String      @id @default(uuid()) @db.Uuid
+  id              String         @id @default(uuid()) @db.Uuid
   // Was a free-text String with no referential integrity — retrofitted to a
   // real FK once Employee records existed to point to (see Employee model
   // above). No production data existed at the time of this change (`requests`
   // table was empty), so this was a plain column-type migration, not a
   // backfill.
-  employeeId String      @map("employee_id") @db.Uuid
-  employee   Employee    @relation(fields: [employeeId], references: [id])
-  type       RequestType
-  reason     String
+  employeeId      String         @map("employee_id") @db.Uuid
+  employee        Employee       @relation(fields: [employeeId], references: [id])
+  type            RequestType
+  reason          String
   // Only the 'Draft' state is implemented so far. Deliberately kept as a
   // plain string (not an enum) until more states exist — see
   // src/lib/requests.ts's RequestStatus type.
-  status     String      @default("Draft")
-  createdAt  DateTime    @default(now()) @map("created_at") @db.Timestamptz(6)
+  status          String         @default("Draft")
+  // Nullable FK to PurchaseOrder — see docs/asset-license-management.md's
+  // "## PurchaseOrder (gộp Receipt)" Traceability bullet. Semantically the
+  // DEMAND side, unlike AssetItem.purchaseOrderId/License.purchaseOrderId
+  // (supply-side intake): this records "which approved Request got grouped
+  // into this PO", not "which PO did this item come in through". Shape is
+  // identical to those two though — nullable FK, set at creation time only,
+  // no update endpoint for this field yet, same P2003-on-insert handling.
+  purchaseOrderId String?        @map("purchase_order_id") @db.Uuid
+  purchaseOrder   PurchaseOrder? @relation(fields: [purchaseOrderId], references: [id])
+  createdAt       DateTime       @default(now()) @map("created_at") @db.Timestamptz(6)
 
   @@map("requests")
 }
@@ -185,8 +194,11 @@ model Vendor {
 // `assetItems` is the back-relation from the AssetItem.purchaseOrderId
 // retrofit (supply-side traceability, same doc section). `licenses` is the
 // back-relation from the License.purchaseOrderId retrofit (same doc
-// section, same rationale). Request back-references are NOT part of this
-// change — out of scope for this task.
+// section, same rationale). `requests` is the back-relation from the
+// Request.purchaseOrderId retrofit — the DEMAND side ("which approved
+// Request got grouped into this PO"), as opposed to assetItems/licenses
+// which are the SUPPLY side (intake traceability) — see Request model's
+// comment above for the distinction.
 model PurchaseOrder {
   id           String      @id @default(uuid()) @db.Uuid
   vendorId     String      @map("vendor_id") @db.Uuid
@@ -199,6 +211,7 @@ model PurchaseOrder {
   createdAt    DateTime    @default(now()) @map("created_at") @db.Timestamptz(6)
   assetItems   AssetItem[]
   licenses     License[]
+  requests     Request[]
 
   @@map("purchase_orders")
 }