v3.18.36 — MoMo polling duplicate-order fix

ajax_momo_check_status() was calling place_order() with no idempotency key, meaning v3.18.35's dedupe protection was completely inert for mtn_momo orders. cart.js was already sending the key unconditionally on every checkout — this release just threads it through the MoMo pending-transient and back out on poll confirmation, so the existing lookup/insert/race-detection logic (proven in v3.18.35) now covers this path too. Also moves the transient deletion earlier, narrowing the race window as a second layer of defense. Residual double-notification edge case on true simultaneous polls is the same known, deferred gap as v3.18.35's offline/COD case. See RELEASE.md.