fix: two bugs in cancellation settings

- settings.py: add orders.waiter_cancellations_allowed to VALID_SETTINGS
  (was missing, causing 400 on every PUT attempt)
- StaffTab.jsx: include can_cancel_orders in edit waiter mutation payload
  (was omitted, so the checkbox change was never sent to the backend)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

local_backend/routers/settings.py

@@ -41,6 +41,8 @@ VALID_SETTINGS = {
     # Beep settings
     "print.beep_on_ticket":    "Play beep when a kitchen ticket prints: 'true' | 'false'",
     "print.beep_pattern":      "Beep pattern: 'single' | 'double' | 'triple' | 'long' | 'custom:n1:n2:n3'",
+    # Phase 2 — cancellations
+    "orders.waiter_cancellations_allowed": "Allow waiters with per-account permission to cancel sent orders: 'true' | 'false'",
 }
 
 DEFAULTS = {