fix: two bugs in cancellation settings

- settings.py: add orders.waiter_cancellations_allowed to VALID_SETTINGS
  (was missing, causing 400 on every PUT attempt)
- StaffTab.jsx: include can_cancel_orders in edit waiter mutation payload
  (was omitted, so the checkbox change was never sent to the backend)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

manager_dashboard/src/pages/StaffTab.jsx

@@ -445,6 +445,7 @@ export default function WaitersPage() {
               mobile_phone: editForm.mobile_phone || null, email: editForm.email || null,
               note: editForm.note || null, role: editForm.role,
               hourly_rate: editForm.hourly_rate !== '' ? parseFloat(editForm.hourly_rate) : null,
+              can_cancel_orders: !!editForm.can_cancel_orders,
             })}
             onUploadAvatar={file => uploadAvatar.mutate({ id: editModal.id, file })}
             onDeleteAvatar={() => deleteAvatar.mutate(editModal.id)}