Restaurant mode Phase 3: table-QR self-ordering into the kitchen

The "links" slice — a guest scans a table's QR, browses the menu (with
modifiers), and submits an order that lands on that table's open tab and fires
straight to the Kitchen Display.

- Public, auth-free flow scoped by an unguessable table short_code:
  GET /t/{code} (menu + client cart), POST /t/{code}/order (throttled),
  GET /t/{code}/done. Orders open/append the table's dine-in tab, add lines as
  source=guest, and send to the kitchen.
- Staff print a per-table QR (Settings → table → QR; renders client-side to the
  public menu URL). short_code is generated lazily.
- Guest lines are badged on the ticket and the KDS so staff can tell them apart;
  staff still settle the tab as usual (cash / Ladill Pay).
- Extracted PosSaleService::buildProductLine as the single product+modifier
  price resolver, now shared by staff and guest ordering (client prices never
  trusted).

Schema additive: pos_tables.short_code, pos_sale_lines.source. New
PosRestaurantTest covers the guest order firing to the kitchen; suite green (12).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

routes/web.php

@@ -12,6 +12,7 @@ use App\Http\Controllers\Pos\SettingsController;
 use App\Http\Controllers\Pos\TableController;
 use App\Http\Controllers\Pos\TicketController;
 use App\Http\Controllers\NotificationController;
+use App\Http\Controllers\Public\TableOrderController;
 use App\Http\Controllers\WalletBalanceController;
 use Illuminate\Support\Facades\Route;
 
@@ -30,6 +31,11 @@ Route::get('/signed-out', fn () => auth()->check() ? redirect()->route('pos.dash
 
 Route::get('/sales/{sale}/callback', [SaleController::class, 'callback'])->name('pos.sales.callback');
 
+// Public table-QR ordering (no auth — scoped by the table short_code).
+Route::get('/t/{code}', [TableOrderController::class, 'menu'])->name('pos.table.menu');
+Route::post('/t/{code}/order', [TableOrderController::class, 'store'])->middleware('throttle:20,1')->name('pos.table.order');
+Route::get('/t/{code}/done', [TableOrderController::class, 'confirmed'])->name('pos.table.confirmed');
+
 Route::middleware(['auth', 'platform.session'])->group(function () {
     Route::get('/wallet/balance', [WalletBalanceController::class, 'balance'])->name('wallet.balance');
 
@@ -50,6 +56,7 @@ Route::middleware(['auth', 'platform.session'])->group(function () {
 
     // Restaurant mode — floor, open tickets (tabs), and the kitchen display.
     Route::get('/floor', [TableController::class, 'index'])->name('pos.floor');
+    Route::get('/floor/tables/{table}/qr', [TableController::class, 'qr'])->name('pos.tables.qr');
     Route::post('/tickets', [TicketController::class, 'open'])->name('pos.tickets.open');
     Route::get('/tickets/{sale}', [TicketController::class, 'show'])->name('pos.tickets.show');
     Route::post('/tickets/{sale}/lines', [TicketController::class, 'addLine'])->name('pos.tickets.lines.add');