fix(portal): submit checkout payments with CSRF protection (v16) - #415

Issue

• Webshop v16 sends the order-page Pay action as GET to ERPNext's POST-only payment-request endpoint. Its button also shows the full invoice total after a partial payment.
• Refs Guest checkout fails on Shopping Cart payment request with PermissionError after upgrade (v16) erpnext#52844. This is the version-16 counterpart of the develop form fix and must be deployed with the ERPNext v16 customer-permission companion. Standard checkout remains restricted to authenticated customers.

Steps to replicate

• Install Payments and Webshop v16, configure a gateway account, and enable checkout.
• Link a website user with the Customer role to a customer and submit an unpaid order for that customer.
• Sign in as that user, open the order page, and click Pay.
• Open an invoice for 1,000 with 400 already paid and inspect the button amount.

Actual behavior

• Pay uses GET and cannot reach the POST-only endpoint.
• The partially paid invoice displays Pay 1,000 instead of the remaining 600.

Expected behavior

• Pay sends a CSRF-protected POST for the remaining payable amount and redirects to the gateway.
• Draft, cancelled, fully paid, and unauthorized documents do not offer Pay.

Backport needed

• Version 16: Covered by this PR; the ERPNext customer-permission companion is required.
• Version 15: Yes, by inspection at Webshop a355cdad44 and ERPNext d17086df9f. The same GET link and Desk-only permission path remain; coordinated adaptation and v15 runtime validation are still required.

Dependencies

• Develop source PR: fix(portal): submit checkout payments with CSRF protection #414. Merge the develop correction first.
• Required ERPNext v16 permission fix: fix(accounts): allow customers to pay their portal documents (v16) erpnext#64260. Deploy both v16 fixes together for customer checkout.