Atomic replacement for the order-create + assign-user + attach-to-event sequence EngineerEventOrderForm.vue used to do as three separate requests. A failure at any step (order validation, assignment, or the handle_event statuscode/measurement side effects) rolls the whole thing back, so a retry after a failure cannot leave an orphan order behind.

The request body is the order-create body (order_create_serializer_for_tenant, plus notify_user); this view carries no separate order envelope key, because a POST body here is already a create-order body and nothing else. Order-field validation errors therefore come back wrapped as {'order': {<field>: [...]}} - one level of nesting so a caller can tell an order-field error apart from anything this endpoint might validate about the event itself in the future.

engineer is not a body field: EngineerEvent.engineer already names it, and the order is always assigned to that engineer - unlike assign-user/<pk>/, which can assign any role's submodel to any order, this endpoint only ever assigns the event's own engineer to the order it just created.

notify_user is a body boolean defaulting to true: send the engineer the same websocket notification assign-user/<pk>/?notify_user=1 sends (see AssignUserView.post). Pass notify_user: false to skip it.

Same permission class as the sibling engineer-event views (EngineerEventListCreate, EngineerEventUpdate): AllowAny, because the mobile app calls these without a planning session either.