Restaurant mode Phase 3: table-QR self-ordering into the kitchen

The "links" slice — a guest scans a table's QR, browses the menu (with
modifiers), and submits an order that lands on that table's open tab and fires
straight to the Kitchen Display.

- Public, auth-free flow scoped by an unguessable table short_code:
  GET /t/{code} (menu + client cart), POST /t/{code}/order (throttled),
  GET /t/{code}/done. Orders open/append the table's dine-in tab, add lines as
  source=guest, and send to the kitchen.
- Staff print a per-table QR (Settings → table → QR; renders client-side to the
  public menu URL). short_code is generated lazily.
- Guest lines are badged on the ticket and the KDS so staff can tell them apart;
  staff still settle the tab as usual (cash / Ladill Pay).
- Extracted PosSaleService::buildProductLine as the single product+modifier
  price resolver, now shared by staff and guest ordering (client prices never
  trusted).

Schema additive: pos_tables.short_code, pos_sale_lines.source. New
PosRestaurantTest covers the guest order firing to the kitchen; suite green (12).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/Http/Controllers/Pos/TicketController.php

@@ -107,29 +107,19 @@ class TicketController extends Controller
         ];
 
         if (! empty($data['product_id'])) {
-            $product = PosProduct::owned($this->ownerRef($request))
-                ->with('modifierGroups.modifiers')
-                ->find($data['product_id']);
+            $resolved = $this->sales->buildProductLine(
+                $this->ownerRef($request),
+                (int) $data['product_id'],
+                $data['modifier_ids'] ?? [],
+                $payload['quantity'],
+                $payload['notes'],
+                $payload['course'],
+            );
 
-            if (! $product) {
+            if ($resolved === null) {
                 return response()->json(['message' => 'Unknown product.'], 422);
             }
-
-            // Only modifiers that belong to this product's groups count.
-            $allowed = $product->modifierGroups->flatMap->modifiers->keyBy('id');
-            $chosen = collect($data['modifier_ids'] ?? [])
-                ->map(fn ($id) => $allowed->get((int) $id))
-                ->filter()
-                ->values();
-
-            $payload['product_id'] = $product->id;
-            $payload['name'] = $product->name;
-            $payload['station_id'] = $product->station_id;
-            $payload['course'] = $payload['course'] ?? $product->course;
-            $payload['unit_price_minor'] = max(1, $product->price_minor + (int) $chosen->sum('price_delta_minor'));
-            $payload['modifiers'] = $chosen->map(fn ($m) => [
-                'modifier_id' => $m->id, 'name' => $m->name, 'price_delta_minor' => $m->price_delta_minor,
-            ])->all();
+            $payload = $resolved;
         } else {
             // Custom (open-price) line.
             $payload['name'] = (string) ($data['name'] ?? '');
@@ -260,6 +250,7 @@ class TicketController extends Controller
             'kitchen_state' => $l->kitchen_state,
             'notes' => $l->notes,
             'course' => $l->course,
+            'source' => $l->source,
             'modifiers' => $l->modifiers->map(fn ($m) => $m->name)->all(),
             'fired' => $l->kitchen_state !== PosSaleLine::KITCHEN_NEW,
         ])->all();