Canteen Management

Spec: clinq-docs/modules/canteen-management/specs/2026-10-29-payroll-deduction-design.md

Replaces the decorative PayrollDeductionDialog (CSV-only, explicitly not a deduction per its own doc comment) with the real thing, for staff categories HR puts on payroll-deduction recovery mode instead of at-counter:

• HR: SubsidyRule.RecoveryMode becomes genuinely settable per staff category; a new internal endpoint upserts an EmployeeDeduction (component CANTEEN, already seeded) for a given employee+period.
• shared-kernel: IHrServiceContract gains its first cross-module WRITE method, CreateCanteenDeductionAsync (default-bodied for additivity).
• Canteen: new SalePaymentMode.PayrollDeduction (nothing collected at the till, mirrors ToIpBill); SaleService.CreateAsync reordered so the resolved subsidy rule is known before payment-mode validation runs; a new export ledger (PayrollDeductionExport/Line) computed from completed sales (not EmployeeMealAccount, to stay correct across mid-month category changes), written only at send time, one per hospital per period.
• Frontend: one real PayrollDeductionDialog shared by a new Finance > Payroll deduction page and the existing Employee-meals button; POS hardcodes PayrollDeduction as the payment mode for payroll-mode employees, same way it already hardcodes ToIpBill for attendants.

Disputes/ESS workflow explicitly out of scope -- the prototype panel has no real data behind it.