Validate AI or OCR quote items against a fixed exact-match price catalog

## Setup and safety boundary - The catalog, prices, labor rate, travel fee, and VAT are synthetic fixtures. Replace them with an authenticated source and approved business rules. - The webhook has no authentication in this template. Add Header Auth or JWT Auth before publishing it. - Treat extracted_items as untrusted AI or OCR output. Prices supplied by that input are ignored. - Unknown references return NEEDS_REVIEW with totals: null. Keep a human approval step before sending a quote. - Test concurrency, rounding, taxes, discounts, audit storage, and retries against your own acceptance cases.