refactor: extract cart storage to dedicated API controller with dynamic frontend URLs

- Added dedicated CartsController for session-based cart storage
- Refactored routes to use POST /api/v1/carts/store
- Updated ticket selection JS to use dynamic data attributes for URLs
- Fixed CSRF protection in API and checkout payment increment
- Made checkout button URLs dynamic via data attributes
- Updated tests for new cart storage endpoint
- Removed obsolete store_cart from EventsController

app/controllers/api/v1/orders_controller.rb

@@ -4,9 +4,6 @@
 module Api
   module V1
     class OrdersController < ApiController
-      # Skip API key authentication for store_cart action (used by frontend forms)
-      skip_before_action :authenticate_api_key, only: [ :store_cart ]
-
       before_action :set_order, only: [ :show, :checkout, :retry_payment, :increment_payment_attempt ]
       before_action :set_event, only: [ :new, :create ]