Creates an in-store (point-of-sale) order up-front (AwaitingCheckout) and returns a hosted
checkoutUrl (/pay/{id}) — the SAME journey as a QR / payment-link order. The customer opens
or scans it to run assessment, SIMAH consent, the promissory note (Sanad), contract acceptance and
payment. No provider session or schedule is created here; that happens through the /pay journey.
Requires scope orders:write.

Idempotency: send an Idempotency-Key header (a fresh UUID v4 per order attempt) and reuse it
on retries — a retry replays the original answer (Idempotent-Replay: true) instead of creating a
second order. 409 REQUEST_IN_PROGRESS while the first attempt is still running (retry shortly);
422 IDEMPOTENCY_KEY_REUSED if the same key is sent with a different body.

Errors: 400 VALIDATION_ERROR, 400 MERCHANT_REQUIRED (an admin token that named no
merchant — see /pay/session/create), 401, 403 (missing orders:write),
409 MERCHANT_SUSPENDED, 429 rate limited.

Return URLs (optional): merchantUrl { success, failure, cancel, notification } — where the
hosted checkout sends the customer afterwards. Same rules as /pay/session/create: absolute, at
most 1024 characters, no fragment; https, http only on localhost / 127.0.0.1, or a custom
app scheme; success and failure together, cancel defaulting to failure, notification
reserved. The page appends orderId, orderReferenceId and status to the URL's own query
string. Confirm with GET /merchant/orders/{orderId} before treating the order as paid.