Guest checkout fails on Shopping Cart payment request with PermissionError after upgrade (v16)

### Information about bug

After upgrading to latest v16 releases, portal/guest checkout fails when customer clicks Pay on order page.

Endpoint used:
http://tmp.localhost:8001/api/method/erpnext.accounts.doctype.payment_request.payment_request.make_payment_request?dn=SAL-ORD-2026-00078&dt=Sales%20Order&submit_doc=1&order_type=Shopping%20Cart

Expected behavior:
For Shopping Cart checkout, customer should be redirected to payment gateway and Payment Request should be created/submitted as before.

Actual behavior:
Request fails with frappe.exceptions.PermissionError at make_payment_request when checking create permission on Payment Request.

Why this seems like a bug/regression:
The endpoint is whitelisted with allow_guest=True, but now enforces Payment Request create permission, which guest/portal users do not have. This breaks standard webshop checkout flow.

Workaround currently used:
Method override in webshop app to handle shopping cart flow with website permission checks.

### Module

accounts

### Version

Frappe version - 16.9.0 (version-16, e5b04e0)
ERPNext version - 16.6.1 (version-16, 9a0b54c)

### Installation method

docker

### Relevant log output / Stack trace / Full Error Message.

```shell
Traceback (most recent call last):
File "apps/frappe/frappe/app.py", line 121, in application
response = frappe.api.handle(request)
File "apps/frappe/frappe/api/init.py", line 63, in handle
data = endpoint(**arguments)
File "apps/frappe/frappe/api/v1.py", line 40, in handle_rpc_call
return frappe.handler.handle()
File "apps/frappe/frappe/handler.py", line 53, in handle
data = execute_cmd(cmd)
File "apps/frappe/frappe/handler.py", line 86, in execute_cmd
return frappe.call(method, **frappe.form_dict)
File "apps/frappe/frappe/init.py", line 1124, in call
return fn(*args, **newargs)
File "apps/frappe/frappe/utils/typing_validations.py", line 36, in wrapper
return func(*args, **kwargs)
File "apps/erpnext/erpnext/accounts/doctype/payment_request/payment_request.py", line 549, in make_payment_request
frappe.has_permission("Payment Request", "create", throw=True)
File "apps/frappe/frappe/init.py", line 621, in has_permission
raise frappe.PermissionError
frappe.exceptions.PermissionError
```