- Add POST /api/bff/pos/orders endpoint (Dapper, order+items+payment_method) - Add CreatePosOrderAsync to PosDataService with camelCase JSON serialization - Wire CafeDesktop ConfirmPayment to API (async, ProductId tracking, fallback) - Add TryRestoreSessionAsync to POS page init for JWT auth - Replace Forbid() with Unauthorized() + diagnostic logging