Validate order items and pickup days against the menu

[kylefritz]

Priority: low — data-integrity hardening. Found during the 2026-06-11 operational-flow audit (F4).

OrdersController#create and #update build order items straight from cart_item_params[:item_id] and [:pickup_day_id] with no check that the item belongs to the order's menu or that the pickup day is one of that menu's pickup_days:

filtered_params = {
  item_id: cart_item_params[:item_id],
  quantity: cart_item_params[:quantity].presence || 1,
  pickup_day_id: cart_item_params[:pickup_day_id] || @menu.pickup_days.first.id
}
order.order_items.create!(filtered_params)

A crafted cart can attach arbitrary Items (including other menus' items or PAY_IT_FORWARD) and arbitrary pickup days. Low security impact on a human-moderated site, but it corrupts order/credit accounting (credits derive from items.credits) and pickup-list generation.

Fix: validate that each item_id is in @menu.items and each pickup_day_id is in @menu.pickup_days before creating order items; reject otherwise.

Related: #170 (order integrity).