Add Cache-Control: no-store for authenticated pages; fix payment onclick encoding

Prevents browsers from caching authenticated pages, which resolves stale/corrupt
cache bugs (e.g. Firefox refusing to navigate to a specific invoice). Also fixes
the Edit Payment button onclick to use Json.Serialize for Reference/Notes so
apostrophes and other special characters don't break the JavaScript string literal.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/PowderCoating.Web/Program.cs

@@ -653,6 +653,11 @@ app.Use(async (context, next) =>
     context.Response.Headers.Append("Permissions-Policy",
         "geolocation=(), microphone=(), camera=()");
 
+    // Prevent browsers from caching authenticated pages — avoids stale data and
+    // browser-specific cache corruption bugs (e.g. Firefox caching a partial load).
+    if (context.User.Identity?.IsAuthenticated == true)
+        context.Response.Headers.Append("Cache-Control", "no-store");
+
     await next();
 });