fix(cash-in): restore cancel button and add displayingQR timeout

Cancel button is now always visible during the cash-in flow. The state
machine routes CANCEL to confirmAbandon when bills are present, so the
user always has an exit path with appropriate warnings. Also adds a
5-minute auto-timeout on displayingQR and allows cancel during
generatingNdebit.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

packages/state-machine/src/machine.ts

@@ -449,7 +449,6 @@ export function createATMMachine(
             },
           },
           generatingNdebit: {
-            // No CANCEL here — bills are already in the cash box
             invoke: {
               src: 'generateNdebit',
               input: ({ context }) => context,
@@ -465,8 +464,14 @@ export function createATMMachine(
                 actions: 'setError',
               },
             },
+            on: {
+              CANCEL: 'confirmAbandon',
+            },
           },
           displayingQR: {
+            after: {
+              TIMEOUT_MS: 'confirmAbandon',
+            },
             on: {
               PAYMENT_RECEIVED: {
                 target: 'askForReceipt',