fix: two bugs in cancellation settings

- settings.py: add orders.waiter_cancellations_allowed to VALID_SETTINGS
  (was missing, causing 400 on every PUT attempt)
- StaffTab.jsx: include can_cancel_orders in edit waiter mutation payload
  (was omitted, so the checkbox change was never sent to the backend)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

local_backend/routers/settings.py

@@ -41,6 +41,8 @@ VALID_SETTINGS = {
     # Beep settings
     "print.beep_on_ticket":    "Play beep when a kitchen ticket prints: 'true' | 'false'",
     "print.beep_pattern":      "Beep pattern: 'single' | 'double' | 'triple' | 'long' | 'custom:n1:n2:n3'",
+    # Phase 2 — cancellations
+    "orders.waiter_cancellations_allowed": "Allow waiters with per-account permission to cancel sent orders: 'true' | 'false'",
 }
 
 DEFAULTS = {

manager_dashboard/src/pages/StaffTab.jsx

@@ -445,6 +445,7 @@ export default function WaitersPage() {
               mobile_phone: editForm.mobile_phone || null, email: editForm.email || null,
               note: editForm.note || null, role: editForm.role,
               hourly_rate: editForm.hourly_rate !== '' ? parseFloat(editForm.hourly_rate) : null,
+              can_cancel_orders: !!editForm.can_cancel_orders,
             })}
             onUploadAvatar={file => uploadAvatar.mutate({ id: editModal.id, file })}
             onDeleteAvatar={() => deleteAvatar.mutate(editModal.id)}