Drain bills to the back office automatically, over MQTT or HTTP

Turns the orders table into a queue that empties itself. Bills were only
uploaded when a cashier pressed Sync at end of day; a till that was never
pressed held a day's takings indefinitely.

Drain engine (lib/data/sync/sync_engine.dart)
- Triggers on sale committed, network regained, 5-minute poll, head-office
  request, and the manual button.
- Single flight: a busy till firing a trigger per sale would otherwise have
  several passes reading the same pending rows and send every bill twice.
  A trigger arriving mid-drain is queued and replayed, so nothing is dropped.
- Exponential backoff with +/-20% jitter to a 5-minute ceiling. The jitter
  matters: a store's terminals all fail at the same instant when the line
  drops, and would retry in lockstep without it.
- Halts rather than loops on a failure retrying cannot fix (bad credential,
  refused batch). Pressing Sync clears the halt.

Transports (lib/data/remote/)
- OrderTransport interface; MQTT, HTTP and simulated implementations. The
  repository does not know which is in use.
- MQTT: QoS 1 uplink, application-level ACK correlated by batch_id on a return
  topic, retained Last Will for terminal-offline detection, downlink for
  catalogue pushes and remote sync requests.
- A broker PUBACK is never treated as acceptance. It means the broker holds
  the bytes, not that the ledger took the sale. Only ids the back office names
  are marked synced; silence leaves a bill pending.
- HTTP carries a stable idempotency key across retries of the same bills.

Retention
- Accepted bills are kept 7 days instead of deleted, so a batch the back
  office later loses can be re-sent in full. Purged after that; archived
  totals stay forever.
- forBusinessDate now reads pending rows only. A retained bill exists in both
  the orders table and day_archive, and summing both would overstate the day.

Fixes found while building this
- SyncEngine._refreshPending wrote state.copyWith(pending: await ...). Dart
  evaluates the receiver before the awaited argument, so a connectivity drop
  during the wait was silently overwritten by the stale snapshot. Caught by
  the first run of the new engine tests.
- PrinterSettingsController wrote state after four awaits with no mounted
  check, throwing "used after dispose" when Settings was left mid-load. This
  was pre-existing and reached the cashier as a red screen.

Also
- Header pill now reports real sync state: LIVE / n QUEUED / SYNCING /
  SYNC HALTED, with an explanation of where the bills are.
- Settings shows the route, last upload, next retry and retention window.
- docs/sync-contract.md states what the back office must implement, including
  the idempotency requirement that at-least-once delivery makes mandatory.

Tests: 90 -> 129 passing. New coverage for backoff shape and jitter band,
single flight, halting, ACK correlation and partial acceptance, at-least-once
duplicate handling, retention and purge, and no double-counting after a sync.
Suite run six times clean.

Not addressed: bills already synced by an older build went up overstated and
still need server-side reconciliation. Broker credentials have no Settings
editor yet.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

lib/app/providers.dart

@@ -1,13 +1,20 @@
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 
+import '../core/config/sync_config.dart';
+import '../core/services/connectivity_service.dart';
 import '../core/services/receipt_service.dart';
 import '../core/services/sound_service.dart';
 import '../data/datasources/local_store.dart';
 import '../data/repositories/customer_repository_impl.dart';
 import '../data/repositories/product_repository_impl.dart';
 import '../data/datasources/remote_catalogue_source.dart';
+import '../data/remote/http_order_transport.dart';
+import '../data/remote/mqtt_order_transport.dart';
+import '../data/remote/order_transport.dart';
+import '../data/remote/simulated_order_transport.dart';
 import '../data/repositories/sync_repository_impl.dart';
 import '../data/repositories/transaction_repository_impl.dart';
+import '../data/sync/sync_engine.dart';
 import '../domain/repositories/customer_repository.dart';
 import '../domain/repositories/product_repository.dart';
 import '../domain/repositories/sync_repository.dart';
@@ -44,20 +51,72 @@ final remoteCatalogueProvider = Provider<RemoteCatalogueSource>(
   ),
 );
 
-final remoteOrderSinkProvider = Provider<RemoteOrderSink>(
-  (ref) => RemoteOrderSink(
-    isOffline: () => ref.read(simulateOfflineProvider),
-  ),
-);
+// ------------------------------------------------------------------- Sync
+/// How this terminal reaches the back office.
+///
+/// Defaults to the simulated route so a fresh install is usable with no broker
+/// and no endpoint; Settings re-points it.
+final syncConfigProvider = StateProvider<SyncConfig>((ref) => const SyncConfig());
+
+/// Real network state, folded with the Settings offline switch.
+final connectivityServiceProvider = Provider<ConnectivityService>((ref) {
+  final service = ConnectivityService(
+    isSimulatedOffline: () => ref.read(simulateOfflineProvider),
+  );
+  ref.onDispose(service.dispose);
+  return service;
+});
+
+/// The wire itself. Rebuilt when the configuration changes, and the old one is
+/// closed so a re-pointed terminal does not keep a stale broker session open.
+final orderTransportProvider = Provider<OrderTransport>((ref) {
+  final config = ref.watch(syncConfigProvider);
+
+  final transport = switch (config.transport) {
+    TransportKind.mqtt => MqttOrderTransport(config: config),
+    TransportKind.http => HttpOrderTransport(config: config),
+    TransportKind.simulated => SimulatedOrderTransport(
+        isOffline: () => ref.read(simulateOfflineProvider),
+      ),
+  };
+
+  ref.onDispose(transport.dispose);
+  return transport;
+});
 
 final syncRepositoryProvider = Provider<SyncRepository>(
   (ref) => SyncRepositoryImpl(
     ref.watch(localStoreProvider),
     ref.watch(remoteCatalogueProvider),
-    ref.watch(remoteOrderSinkProvider),
+    ref.watch(orderTransportProvider),
+    batchSize: ref.watch(syncConfigProvider).batchSize,
   ),
 );
 
+/// Decides when bills are uploaded. Started once, by the app shell.
+final syncEngineProvider = Provider<SyncEngine>((ref) {
+  final transport = ref.watch(orderTransportProvider);
+
+  final engine = SyncEngine(
+    repository: ref.watch(syncRepositoryProvider),
+    connectivity: ref.watch(connectivityServiceProvider).onlineChanges,
+    downlink: transport.downlink,
+    onCatalogueChanged: () async {
+      await ref.read(syncRepositoryProvider).importCatalogue();
+      ref.invalidate(localStoreProvider);
+    },
+  );
+
+  ref.onDispose(engine.dispose);
+  return engine;
+});
+
+/// Live engine state for the header pill and the events screen.
+final syncEngineStateProvider = StreamProvider<SyncEngineState>((ref) {
+  final engine = ref.watch(syncEngineProvider);
+  return engine.states.map((s) => s);
+});
+
 // ------------------------------------------------------------- Use cases
 final checkoutSaleProvider = Provider<CheckoutSale>(
   (ref) => CheckoutSale(