The correct SOQL query to return a unique list of Contact records that have no 'Fulfilled' Orders is one that selects Ids from the Contact object where the Contact Id is not in the set of Contact Ids related to 'Fulfilled' Orders. This is done by a subquery that selects the Contact__c field from the Order__c records where the Status__c is 'Fulfilled'.

When a test class fails with an "Insufficient privileges" error during deployment, it indicates that the user profile under which the tests are being executed doesn't have the necessary permissions to perform the actions required by the test. In a sandbox, the test might have been running with a different set of permissions compared to the production environment.
By using System.runAs(), you can specify a user context in which the test should run, which allows you to simulate the appropriate permissions. For this to work, you need to create a User instance in your test class with the profile that has the necessary permissions and then enclose the logic of your test within a System.runAs() block with this user.
This is a preferred solution over seeAllData=true, which would give the test access to all data in the production environment, potentially leading to tests that are not isolated and thus less reliable. It's also preferred over changing organization-wide settings or relying on specific setup in test classes, such as making sure Test.startTest() is not inside a loop.
Salesforce Documentation on Using the runAs Method: Testing with the runAs Method Salesforce Help Article on System Permissions: Profiles and Permissions

Custom Apex REST services are the optimal solution for integrating Salesforce with an external PIM system. When a product is created or updated in the PIM, the external system can make a REST call to a custom Apex REST endpoint in Salesforce, which then can create or update the Product2 and PricebookEntry records. This method allows using custom settings to determine the Pricebook2 dynamically.

Bulk-safe triggers use collections to aggregate DML operations. This practice minimizes the number of DML statements, which is essential for bulk processing.

For the data to be passed back to the Aura component, all properties of the Apex class that are intended to be accessed from the component need to be annotated with @AuraEnabled. Without this annotation, the Aura framework cannot serialize the properties to send them to the front end.