Add a per-event walk-in price and a POS tender to the door screen.

Events can now set an optional walk-in price (events.walk_in_price):
null falls back to the ticket price, 0 is a free walk-in. It is set in
the Create/Edit Event modal (EN/ES) and carried through create, update
and duplicate, but it is internal: public event responses and the
attendee-facing ticket/dashboard endpoints drop it, and only admin,
organizer and staff callers receive it.

The door screen no longer trusts the amount the client sends. It sends
a quantity and the server prices the charge from the event record:
walk-ins pay the walk-in price, existing tickets the ticket price. A
typed amount is only honoured with amountOverride from admin/organizer
and is written to audit_logs in the same transaction. The charged
amount stays snapshotted on the payment row.

POS is a new door tender for the physical card terminal. Staff pick
POS, see the amount to key in, charge the card, then confirm with
"Mark as paid"; it is then recorded like any other door payment
(provider and method 'pos'). It can be switched off globally or per
event via payment options, and shows up in the payments filters,
bookings, revenue summaries and door takings. PosChargePanel is where
an automatic terminal push would go later; nothing calls a terminal
today.

tickets.booking_source (online | walk_in | admin) records how a booking
was made. The migration backfills walk-ins from the door screen's
idempotency records; everything else stays online.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

backend/src/lib/doorPayments.ts

@@ -1,6 +1,6 @@
 // Door payment tenders.
 //
-// The door check-in screen offers four one-tap tenders. Each maps onto an
+// The door check-in screen offers five tenders. Each maps onto an
 // existing payments.provider so the rest of the app (capacity, sweeps, admin
 // payment lists, receipts) keeps working unchanged, while payments.method
 // records which tender was actually used for the end-of-night cash-up.
@@ -9,27 +9,49 @@
 // already made — the same trust model as cash, no invoice generated. When a real
 // Lightning flow lands it slots in here: the tender keeps its name and provider,
 // only the settlement path in routes/door.ts changes.
+//
+// POS is the physical card terminal. Staff open the POS step, which shows the
+// amount to key into the terminal, charge the card, then confirm "Mark as paid";
+// only that confirmation reaches this API, recorded like any other tender. A
+// future automatic amount push to the terminal belongs in the POS step itself
+// (frontend PosChargePanel) plus a 'terminal' settlement here — nothing talks to
+// the terminal today.
 
-export const DOOR_PAYMENT_METHODS = ['cash', 'bitcoin', 'transfer', 'guest'] as const;
+export const DOOR_PAYMENT_METHODS = ['cash', 'bitcoin', 'transfer', 'pos', 'guest'] as const;
 
 export type DoorPaymentMethod = (typeof DOOR_PAYMENT_METHODS)[number];
 
 interface DoorTender {
   /** Existing payments.provider this tender is stored as. */
-  provider: 'cash' | 'lightning' | 'bank_transfer';
+  provider: 'cash' | 'lightning' | 'bank_transfer' | 'pos';
   /** Human label used in payment references and toasts. */
   label: string;
   /** Comp tenders carry no revenue and always record a zero amount. */
   isComp: boolean;
+  /**
+   * How the money is confirmed before the door screen records it:
+   *   'on_tap'        staff already hold the money when they tap (cash, …)
+   *   'staff_confirm' staff charge an external device first, then confirm
+   */
+  confirmation: 'on_tap' | 'staff_confirm';
 }
 
 export const DOOR_TENDERS: Record<DoorPaymentMethod, DoorTender> = {
-  cash: { provider: 'cash', label: 'cash', isComp: false },
-  bitcoin: { provider: 'lightning', label: 'bitcoin', isComp: false },
-  transfer: { provider: 'bank_transfer', label: 'transfer', isComp: false },
-  guest: { provider: 'cash', label: 'guest', isComp: true },
+  cash: { provider: 'cash', label: 'cash', isComp: false, confirmation: 'on_tap' },
+  bitcoin: { provider: 'lightning', label: 'bitcoin', isComp: false, confirmation: 'on_tap' },
+  transfer: { provider: 'bank_transfer', label: 'transfer', isComp: false, confirmation: 'on_tap' },
+  pos: { provider: 'pos', label: 'POS', isComp: false, confirmation: 'staff_confirm' },
+  guest: { provider: 'cash', label: 'guest', isComp: true, confirmation: 'on_tap' },
 };
 
+/**
+ * Tenders that can be switched off per event through payment options. Only POS
+ * is configurable: the other door tenders are always available to staff.
+ */
+export function enabledDoorMethods(opts: { posEnabled: boolean }): DoorPaymentMethod[] {
+  return DOOR_PAYMENT_METHODS.filter((m) => m !== 'pos' || opts.posEnabled);
+}
+
 export function isDoorPaymentMethod(value: unknown): value is DoorPaymentMethod {
   return typeof value === 'string' && (DOOR_PAYMENT_METHODS as readonly string[]).includes(value);
 }