case 4720 - restricted roles get filtered work order items in report data, rendering and export

Opening a work order filters it for restricted users (TechRestricted,
SubContractor, SubContractorRestricted): only items they are scheduled on, and
on those only their own labour, travel and scheduling, and for some roles no
parts, units, expenses etc. Report data, rendering and export went through
WorkOrderGetPartialAsync, which filtered nothing for child types (security
review F27). Two causes:
- the partial fetch now applies the same filtering: the item only if the user
  is scheduled on it (checked in the database), then its details filtered; the
  existing per-item filtering moved unchanged into RemoveRestrictedUserItemDetails
  so both fetches share it;
- BizObjectFactory created WorkOrderBiz with UserType.Service for everyone, so
  in these paths a subcontractor was never treated as one; it now passes the
  user's real type (only the subcontractor flags depend on it).

Checked: report data for a restricted subcontractor on work order 1 went from
the whole item with parts to none; scheduled on an item, it gets the item
without parts or other users' labour. Full suite: 111 passed, 5 skipped, the
same 2 known failures.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

devdocs/modernization/NET10-PORT.md

@@ -186,7 +186,7 @@ John's "next release" cases for AyaNova (exported 2026-10-24). Each is its own s
 | 4717 | KPI interval allowlist | F26. **Done** (`KPIFetcher.DateTruncUnitOrNull` in the 7 KPIs reading `interval`; test `KpiInterval`) |
 | 4718 | Report and translation import need create rights | F19, F24. **Done** (contact and Service 403, BizAdmin 202; test `ImportRights`) |
 | 4719 | Report page network restricted; notification reports not run as SuperUser | F20 |
-| 4720 | Restricted roles filtered in report/export data | F27 |
+| 4720 | Restricted roles filtered in report/export data | F27. **Done** (partial fetch filtered like the full one; BizObjectFactory passed UserType.Service for everyone, now the real type; test `RestrictedReportData`) |
 | 4721 | Client escaping of record text | F33 |
 | 4722 | DOMPurify and Vuetify upgrades (raven-client) | F34 |
 | 4723 | Direct SMTP: address from the record only | F3, F4 |