v1.10.3: PickableStaging put-away + cross-PO receipt-cancel guard

Patch release. Two floor-operations fixes from production: PickableStaging bins become valid put-away sources (matching the receive screen), and receipt cancel gains a cross-PO guard after a single Cancel tap was observed reversing 564 receipts across 17 POs.

Mobile. The put-away fix has a handheld half: PutAwayScreen accepts both staging bin types on bin-scan and item-scan. Mobile version moves to 1.10.3 (versionCode 7). No standalone v1.10.3 APK is published; the handheld half of the put-away fix ships in the next APK build (first mobile-feature release after this one), which covers everything since the v1.9.0 baseline. Stay on v1.9.0 until then if you do not put away from PickableStaging bins.

Fixed

• PickableStaging bins are valid put-away sources (#343): items received into PickableStaging tray bins (which stay sales-pickable for concurrency) were invisible to the handheld put-away flow. pending_putaway() extends its bin_type filter to IN ('Staging','PickableStaging'); the handheld accepts both. Backward-compatible with the v1.9.0 handheld.
• Receipt cancel refuses cross-PO sweeps (#344): the mobile receive screen accumulates receipt_ids across every PO loaded in a session, so one Cancel tap could reverse receipts on POs the operator never intended to touch. po_id is now required on the cancel request, and a pre-flight check refuses the cancel -- before any state is touched -- when any visible receipt belongs to a different PO.

Migrations

None on this release.

See CHANGELOG.md for the full notes.