fix(security,pos): close payment/push/PII gaps from app review

- Payments: reject RecordPaymentsAsync when the order is already Delivered/
  Cancelled (ORDER_ALREADY_CLOSED) — prevents duplicate payments, double loyalty
  earn, and overstated cash drawer from a double-tap or paying a reopened order.
- Push broadcast: POST /api/push/broadcast was [Authorize]-only (any user → any
  topic, platform-wide). Now requires SendSms + café context and is forced to the
  caller's own topic (cafe-{slug}); arbitrary/cross-café topics rejected.
- HR reads: GetEmployees/GetAttendance/GetShifts now require ViewStaff/
  ViewAttendance/ViewSchedules (were café-access-only, leaking roster PII the UI
  already hid). Expenses list now requires ViewExpenses.
- Receipt: removed the auto-print on full payment so the POS success sheet is the
  single print path (no more double receipt).

Local build blocked by NU1301 (NuGet network unreachable); CI builds via mirror.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/Meezi.API/Services/OrderService.cs

@@ -1039,6 +1039,12 @@ public class OrderService : IOrderService
         if (order is null)
             return new OrderServiceResult<IReadOnlyList<PaymentDto>>(false, null, "ORDER_NOT_FOUND");
 
+        // Never take payment on an already-closed order — a double-tap on Pay, or
+        // paying a closed order reopened from the board, would otherwise record
+        // duplicate payments, re-earn loyalty, reprint, and overstate the drawer.
+        if (order.Status is OrderStatus.Delivered or OrderStatus.Cancelled)
+            return new OrderServiceResult<IReadOnlyList<PaymentDto>>(false, null, "ORDER_ALREADY_CLOSED");
+
         var branchId = await ResolveOrderBranchIdAsync(order, cafeId, cancellationToken);
         if (string.IsNullOrEmpty(branchId))
             return new OrderServiceResult<IReadOnlyList<PaymentDto>>(false, null, "NO_OPEN_SHIFT", "branchId");
@@ -1125,7 +1131,8 @@ public class OrderService : IOrderService
 
         if (paidTotal >= order.Total)
         {
-            PrinterBackgroundJobs.QueueReceiptPrint(_scopeFactory, cafeId, orderId);
+            // Receipt is printed explicitly from the POS success sheet (single
+            // print path) — no auto-print here, to avoid a duplicate receipt.
             await _loyalty.ApplyEarnOnOrderPaidAsync(cafeId, order.CustomerId, paidTotal, cancellationToken);
             await _deliverySync.SyncInternalStatusAsync(cafeId, orderId, OrderStatus.Delivered, cancellationToken);
         }