Fix final-review findings: normalize order total, re-check tolerance against authoritative total, wrap HTTP errors, log orphan orders, add outbound timeout

- SobanleClient.createSale: coerce grand_total to a rounded Number and
  reject non-finite/non-positive values before it crosses into the epay
  signature and the DB amount, so a decimal-string API response can't
  desync the signed value from the stored/transmitted one.
- productComboPicker.computeLineTotal: coerce tax.rate with Number()
  instead of a strict typeof check, so a string rate is honored instead
  of silently defaulting to 0%.
- SobanleClient.createAutoOrder: reject with SOBANLE_TOTAL_EXCEEDS_TARGET
  and log the order context when the POS's authoritative grand_total
  exceeds targetAmount — the spec's tolerance was only ever checked
  against the local estimate, never the real total.
- SobanleClient.withAuthRetry: wrap non-2xx response bodies into real
  Error objects with a statusCode, instead of forwarding the raw body
  as err (previously every real HTTP failure logged `message: undefined`
  with no status code).
- admin.server.controller.js createTransaction: log the Sổ Bán Lẻ
  sobanleOrderId/total when the follow-up AdminTransaction DB write
  fails, so an order left orphaned in the POS can be found later.
- ApiRequest.js: add timeout: 15000 to the three *OtherUrlWithHeader
  functions so a hung Sổ Bán Lẻ call can't hang the admin's request
  indefinitely (also benefits the existing Appota caller).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017KPzWwuTEeX2vXGXvyGn4q