feat: add live order queue demo

[jh1nresh]

Summary

• add buyer-scoped live queue snapshots with position, orders ahead, live wait, and promised-ready metadata
• update the Raposa buyer demo to use quote-bound consent, an authenticated buyer session, short polling, in-page status, and optional browser notifications
• protect merchant order listings, add live merchant-board updates/notifications, and preserve buyer/merchant isolation
• fix queue ETA alignment so capacity windows return the earliest valid wait instead of an inflated hardcoded offset
• document the demo flow and extend smoke coverage for tracking, authorization, queue exit, and generated UI behavior

Verification

• pnpm check
• cd sllr-agent && npm run check
• git diff --check
• scripts/brain containment check --strict
• browser demo: create order → merchant accepts → marks ready → buyer updates automatically → paid/claimed → canonical receipt appears
• browser console: no JavaScript errors

Demo boundary

• live updates use two-second authenticated short polling rather than SSE/WebSockets, matching the current serverless-compatible architecture
• browser notifications require user permission and HTTPS or localhost; in-page updates remain the guaranteed surface
• public deployment must configure merchant verifier credentials and SLLR_REQUIRE_BUYER_AUTH=true
• no new payment rail, deployment, OKX.AI registration, or external notification provider is included

Risk / rollback

The main behavioral changes are protected merchant-list reads and the capacity-aware ETA calculation. Existing smoke coverage exercises both. Rollback is a single revert of this commit.