fix(pos,billing): close post-merge review gaps #1409

Address four reproduced follow-up defects across PRs #1392, #1394, and #1400:

1. POS checkout session-continuation guard (frontend/src/app/(dashboard)/pos/page.tsx, PR feat(auth): fast cashier switch by PIN #1392): Switching users closes checkout UI but leaves in-flight asynchronous checkout continuations running, allowing a delayed order response to generate and pay a bill under the newly signed-in user's token and shift and clear their restored cart. Guard asynchronous continuations with the originating session while preserving committed-order recovery state.
2. Transactional payments.take recheck (main/routes/bills.ts, PR feat(billing): payment method correction #1394): Payment-method correction checks payments.take before asynchronous PIN verification, while the transaction only rechecks the caller's role and active status. Recheck hasPermission(liveCaller.id, 'payments.take') inside the correction transaction.
3. Custom charges in archived daily invoices (main/services/daily-invoices-export.ts, PR feat(reports): batch export daily invoices PDF #1400): Daily invoice export omits charges_breakdown and renders only standard service, packaging, and delivery charges. Carry charges_breakdown into the export dataset and reuse receiptChargeLines while retaining the legacy fallback.
4. Authenticated staff read access to auto_lock_minutes (main/routes/settings.ts, PR feat(auth): fast cashier switch by PIN #1392): GET /api/settings/auto_lock_minutes rejects valid staff users who only hold dashboard/report permissions with 403, leaving their session with a zero idle-lock timeout. Allow every active authenticated staff user to read auto_lock_minutes.