Restaurant mode Phase 3: table-QR self-ordering into the kitchen

The "links" slice — a guest scans a table's QR, browses the menu (with
modifiers), and submits an order that lands on that table's open tab and fires
straight to the Kitchen Display.

- Public, auth-free flow scoped by an unguessable table short_code:
  GET /t/{code} (menu + client cart), POST /t/{code}/order (throttled),
  GET /t/{code}/done. Orders open/append the table's dine-in tab, add lines as
  source=guest, and send to the kitchen.
- Staff print a per-table QR (Settings → table → QR; renders client-side to the
  public menu URL). short_code is generated lazily.
- Guest lines are badged on the ticket and the KDS so staff can tell them apart;
  staff still settle the tab as usual (cash / Ladill Pay).
- Extracted PosSaleService::buildProductLine as the single product+modifier
  price resolver, now shared by staff and guest ordering (client prices never
  trusted).

Schema additive: pos_tables.short_code, pos_sale_lines.source. New
PosRestaurantTest covers the guest order firing to the kitchen; suite green (12).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/Feature/PosRestaurantTest.php

@@ -156,6 +156,37 @@ class PosRestaurantTest extends TestCase
             ->assertJsonPath('tickets.0.lines.0.modifiers.0', 'Large');
     }
 
+    public function test_guest_table_qr_order_fires_to_kitchen(): void
+    {
+        $user = $this->user();
+        [, $table, $product] = $this->restaurant($user);
+        $code = $table->ensureShortCode();
+
+        // Public menu loads with no auth.
+        $this->get(route('pos.table.menu', $code))->assertOk()->assertSee($product->name);
+
+        // Guest submits an order from the table.
+        $this->postJson(route('pos.table.order', $code), [
+            'customer_name' => 'Ama',
+            'items' => [
+                ['product_id' => $product->id, 'quantity' => 2, 'modifier_ids' => [], 'notes' => 'extra hot'],
+            ],
+        ])->assertOk()->assertJsonStructure(['redirect']);
+
+        $sale = PosSale::where('owner_ref', $user->public_id)->firstOrFail();
+        $this->assertSame(PosSale::ORDER_DINE_IN, $sale->order_type);
+        $this->assertSame($table->id, $sale->table_id);
+        $this->assertSame('Ama', $sale->customer_name);
+        $this->assertSame(PosSale::KITCHEN_ACTIVE, $sale->kitchen_status);
+        $this->assertSame(PosTable::STATUS_OCCUPIED, $table->fresh()->status);
+
+        $line = $sale->lines()->firstOrFail();
+        $this->assertSame('guest', $line->source);
+        $this->assertSame(2, $line->quantity);
+        $this->assertSame('extra hot', $line->notes);
+        $this->assertSame(PosSaleLine::KITCHEN_QUEUED, $line->kitchen_state);
+    }
+
     public function test_cannot_open_two_tabs_on_one_table(): void
     {
         $user = $this->user();