Dedup guard for GA4 purchase events

Adds in-flight guards to PesaPal and MoMo status-polling loops and a purchase-fired guard across all four purchase call sites in cart.js. Prevents duplicate GA4 purchase events (and inflated revenue) when overlapping poll responses both resolve paid. No event names, parameters, or order logic changed.