fix(pos): make cart identity and append retries collision-safe

[khaira777]

Summary

POS cart identity and append-item retry state are not robust against distinct configurations or renderer reloads.

Current behavior

• frontend/src/store/cart.ts:32-72 builds cart IDs by joining product, add-on, and free-text instruction fields with -. Delimiter-bearing input can collide and merge distinct lines.
• frontend/src/app/(dashboard)/pos/page.tsx:94,694-717 keeps the append-items idempotency key only in memory. A reload after the server commits but before the response can generate a new key and append items again.

Expected behavior

Distinct cart configurations must remain distinct, and a renderer reload must not turn a committed append request into a duplicate.

Acceptance criteria

• Use structured/escaped fields or a collision-resistant hash for cart identity.
• Persist append attempts with an order/cart fingerprint and recover them after reload.
• Clear an attempt only after a confirmed server response.
• Add delimiter-collision and response-loss/reload tests.

Relevant files

frontend/src/store/cart.ts, frontend/src/app/(dashboard)/pos/page.tsx