Fix saveOrderTypes: add X-Business-ID header for auth

Application.cfm requires request.BusinessID from session or header.
The fetch was only sending it in the POST body which the auth layer
doesn't read.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

portal/index.html

@@ -806,7 +806,7 @@
   <!-- Toast Container -->
   <div class="toast-container" id="toastContainer"></div>
 
-  <script src="portal.js?v=15"></script>
+  <script src="portal.js?v=16"></script>
 
   <!-- Close dropdown when clicking outside -->
   <script>

portal/portal.js

@@ -917,7 +917,7 @@ const Portal = {
     try {
       const response = await fetch(`${this.config.apiBaseUrl}/businesses/saveOrderTypes.cfm`, {
         method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
+        headers: { 'Content-Type': 'application/json', 'X-Business-ID': this.config.businessId },
         body: JSON.stringify({ BusinessID: this.config.businessId, OrderTypes: types.join(',') })
       });
       const data = await response.json();