Expose verified cloud delivery for mobile receipts

[sridharkalaibala]

Mobile receipts now distinguish local server acceptance from explicit downstream cloud delivery. A new authenticated status endpoint returns evidence only when the signed sync component has recorded a matching gateway receipt for the exact transaction, server sale, branch, license, staff and issuing phone. Community installations and older components remain server-only.

This read-only path never resubmits a sale or treats an empty outbox as cloud success. Cloud receipt evidence and component capability records stay local; ordinary sale/stock synchronization remains unchanged. Gateway protocol support is in Posnic/Gateway#30.

Validation: 11,569 API tests passed (13 existing skips), 3,631 desktop tests passed (5 existing skips), and all 22 real-database/mobile integration cases passed. The live mobile UI test observes the cloud label from matching evidence. Isolation tests reject foreign devices/users, wrong branches and wrong receipt IDs. API docs, targeted lint and attribution checks pass.

[github-actions]

Merged to develop. Anyone can test this - you do not need write access.

Try it at https://develop.posnic.io, or run it yourself:

git fetch origin develop && git checkout develop
npm install && npm --prefix api install
npm run dev   # then http://localhost:3000

When you have tested it, say what you did and what happened, and set
QA passed or QA failed. If you cannot set labels, just comment -
a maintainer will.

Reporting that something is broken is as useful as fixing it. It is
better found here than by a shopkeeper.