Fix proxied checkout CSRF for Merchant, Give, Invoice and Events.

Public order/pay POSTs hit ladl.link first; satellite CSRF tokens cannot bind
to Link (or platform/satellite) sessions, which returned 419 and showed
"Could not start checkout." Except public checkout paths and return
access_code from owner-gateway Paystack init. Sync contained Paystack sheet.

bootstrap/app.php

@@ -13,6 +13,13 @@ return Application::configure(basePath: dirname(__DIR__))
         health: '/up',
     )
     ->withMiddleware(function (Middleware $middleware): void {
+        // Storefront/booking POSTs are proxied ladl.link → platform → Merchant without
+        // a browser session cookie that matches merchant CSRF tokens.
+        $middleware->validateCsrfTokens(except: [
+            'q/*/order',
+            'q/*/booking',
+        ]);
+
         $middleware->redirectGuestsTo(fn (Request $request) => route('sso.connect', [
             'redirect' => $request->fullUrl(),
         ]));