Waiter mode: staff floor view with table sessions and one-use staff links

[vekexasia]

Summary

A staff-facing floor mode on top of self-ordering (#11): a server takes and tracks orders for every table from their own device. Reuses the ordering module, kitchen board, and order lifecycle from #11.

Staff access (diverges from the original draft)

No admin login for waiters — /admin stays pure backoffice. Instead:

• Named staff links. The operator generates a named link (/staff?token=XYZ, shareable as QR) from an admin page. The name identifies the waiter ("Marco", "extra weekend").
• One-use. On first open the token is exchanged for a session stored in the device's localStorage and the link dies — it can't be shared afterwards.
• Revocable. Admin lists links (name, created, last seen) and can revoke a waiter's active session at any time, even after the link was consumed.

/staff area

• Floor view: flat list of tables (no positioned map) with each table's state at a glance: free, open orders, ready to serve.
• Explicit table sessions: opening a table starts a table_session; it stays open until a server explicitly closes it. Multiple orders per session.
• Append-only: submitted orders are immutable (consistent with Self-order at the table (intent capture, no payment) #11's whole-order-only model). "Editing a table" means adding another order to its session.
• Order taking: reuses the diner menu/selection UI with the table already in context — no separate compact picker.
• Status on the table: the server sees each order's submitted → ready → served state and can mark orders served on delivery. The full kitchen board stays admin-only.

Order review (/order-review)

The diner QR from #19 moves from /admin/order-review to a top-level /order-review route (no /admin leak in diner-facing URLs). The page requires a valid staff session: a diner opening their own QR sees a "staff area, ask the personnel" message and cannot self-submit. The old /admin/order-review page is removed — one place to maintain.

Tables

Admin CRUD page (same pattern as order destinations from #18): name, active flag. Flat list, no floor-plan layout.

Schema

• staff_links (named token, consumed/session state, revocation)
• tables
• table_sessions (open/close, groups orders)
• orders.tableSessionId nullable — accepted optionally on both submit paths (Self-order #1: direct submit (schema, daily numbering, rate-limit + idempotency) #17 direct and Self-order #3: waiter QR handoff (order intents, cross-device review) #19 intent-consume), per the forward note in Self-order #3: waiter QR handoff (order intents, cross-device review) #19. No duplicate submit path.

Non-goals (v1)

Payments / tabs / bill splitting. Auto-close or table timeouts. Per-server sections or shift assignment. Floor-plan layout editor. Editing already-submitted orders. Kitchen board inside /staff.

Depends on

#11 (done: #17, #18, #19, #20).

[vekexasia]

Implemented and merged in #28. CI is green, including backend, frontend/build, demo build, chat worker, website build, secret scanning, and serial real-backend E2E.