[CO-09] Add price snapshot and restaurant-scoped validation to place_order()

[Leothosine]

Problem

contracts/order/src/lib.rs - place_order() accepts caller-provided unit_price values per item with no on-chain validation. This has three attack vectors:

1. A caller can submit any price (e.g., 1 stroop for a 50,000-stroop meal)
2. A caller can submit a menu_item_id from a different restaurant, polluting order history
3. If prices change between order creation and dispute resolution, there is no historical record of what was charged

Proposed Solution

1. Add a MenuItemSnapshot { menu_item_id: u64, name: Symbol, price_at_order: i128 } struct
2. In place_order(), make a cross-contract call to validate menu_item_id belongs to restaurant_id and retrieve the authoritative price
3. Ignore the caller-supplied unit_price; use only the on-chain price for total calculation
4. Store the MenuItemSnapshot on each OrderItem in persistent storage

Acceptance Criteria

• place_order() with a menu_item_id not belonging to restaurant_id panics with "item not on menu"
• Order total uses the on-chain authoritative price, not the caller-supplied price
• OrderItem in storage contains price_at_order from the snapshot
• A caller submitting unit_price = 1 for a 50,000-stroop item pays 50,000 stroops
• Unit tests mock the menu item price lookup with both valid and invalid item IDs

[Menjay7]

Hi! I came across this issue and would love to work on it. I have experience with similar tasks and I'm confident I can investigate, implement a clean solution, and thoroughly test it before submitting a PR. If the issue is still open, I would appreciate it if you could assign it to me. Thank you!

[Ibinola]

Can i work on this ? i'd add the price snapshot, and implement the validation place_order()

[grantfox-oss]

🦊 GrantFox — @Ibinola has been assigned to this issue as part of the Official Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #287)
2. Your PR will be reviewed by the tosirano maintainers

Good luck! Track your progress on GrantFox.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Official Campaign campaign!

@Ibinola's PR #298 was approved and merged by @Leothosine.

🏆 @Ibinola: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (681 total points). Track your full progress on GrantFox.

👏 Great work, @Ibinola! Keep contributing to tosirano.