fix: harden the serve_kot endpoint so serving a KOT cannot be forged by arb

[esafwan]

What it does / Summary

Hardens the serve_kot API endpoint in ury/ury/api/ury_kot_display.py by enforcing POST HTTP method restriction, role-based authorization, branch-level scoping, and server-side timestamp generation.

What it solves / Motivation

• Resolves security finding SEC-17 by preventing unauthorized or cross-branch users from forging KOT serving actions.
• Eliminates reliance on untrusted client-supplied timestamps by using the server clock for production time calculations and served timestamp logging.

Key Technical Changes

• HTTP Method & Role Authorization:
  • Updated decorator to @frappe.whitelist(methods=["POST"]).
  • Enforced role check requiring one of URY Manager, URY Captain, System Manager, or Administrator (raising PermissionError otherwise).
• Branch Validation:
  • Compares target URY KOT branch against caller's branch via getBranch() (bypassed for System Manager and Administrator).
• Server Clock Timestamping:
  • Overrode client-supplied time argument with server current_time.strftime("%I:%M:%S %p") to prevent timestamp spoofing while maintaining backward compatibility for call signatures.