Restaurant mode Phase 3: table-QR self-ordering into the kitchen

The "links" slice — a guest scans a table's QR, browses the menu (with
modifiers), and submits an order that lands on that table's open tab and fires
straight to the Kitchen Display.

- Public, auth-free flow scoped by an unguessable table short_code:
  GET /t/{code} (menu + client cart), POST /t/{code}/order (throttled),
  GET /t/{code}/done. Orders open/append the table's dine-in tab, add lines as
  source=guest, and send to the kitchen.
- Staff print a per-table QR (Settings → table → QR; renders client-side to the
  public menu URL). short_code is generated lazily.
- Guest lines are badged on the ticket and the KDS so staff can tell them apart;
  staff still settle the tab as usual (cash / Ladill Pay).
- Extracted PosSaleService::buildProductLine as the single product+modifier
  price resolver, now shared by staff and guest ordering (client prices never
  trusted).

Schema additive: pos_tables.short_code, pos_sale_lines.source. New
PosRestaurantTest covers the guest order firing to the kitchen; suite green (12).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/Models/PosTable.php

@@ -5,6 +5,7 @@ namespace App\Models;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Support\Str;
 
 class PosTable extends Model
 {
@@ -21,10 +22,25 @@ class PosTable extends Model
         'label',
         'seats',
         'status',
+        'short_code',
         'current_sale_id',
         'position',
     ];
 
+    /** Ensure the table has a unique public short code for QR ordering. */
+    public function ensureShortCode(): string
+    {
+        if (! $this->short_code) {
+            do {
+                $code = strtolower(Str::random(8));
+            } while (static::where('short_code', $code)->exists());
+
+            $this->forceFill(['short_code' => $code])->save();
+        }
+
+        return $this->short_code;
+    }
+
     protected function casts(): array
     {
         return [