Fix proxied checkout CSRF for Merchant, Give, Invoice and Events.

Public order/pay POSTs hit ladl.link first; satellite CSRF tokens cannot bind
to Link (or platform/satellite) sessions, which returned 419 and showed
"Could not start checkout." Except public checkout paths and return
access_code from owner-gateway Paystack init. Sync contained Paystack sheet.

bootstrap/app.php

@@ -13,11 +13,16 @@ return Application::configure(basePath: dirname(__DIR__))
         health: '/up',
     )
     ->withMiddleware(function (Middleware $middleware): void {
-        // Public QR action POSTs land on ladl.link first; CSRF tokens from satellite HTML (Events/Mini)
-        // do not match Link's session — same failure mode as Laravel 419 Page Expired.
+        // Public QR/checkout POSTs land on ladl.link first; CSRF tokens rendered in
+        // satellite HTML (Merchant/Give/Events/Mini/Invoice) do not match Link's
+        // session — same failure mode as Laravel 419 Page Expired / "Could not start checkout".
         $middleware->validateCsrfTokens(except: [
             '*/register',
             '*/pay',
+            '*/order',
+            '*/booking',
+            '*/book/order',
+            'i/*/pay',
         ]);
 
         $middleware->redirectGuestsTo(fn (Request $request) => route('sso.connect', [