You don't sound batshit at all, OP. The nanny should have mentioned it from the start. I find the food incident particularly egregious - how did the mother know to order food using this phone? It seems pretty unlikely your nanny wasn't involved in instigating that. That is really disrespectful.
But you're the boss here and it is on you to sort it out. It's hard for nanny's (or any domestic home workers) to put boundaries in place that aren't explicit and clearly backed up by their employers (though spending your boss's money on someone else is a pretty easy one to be strong on).
It's possible the mother and nanny have become friends - has the nanny said anything that indicates whether or not she likes her coming over?
It may be you just need to tell her it's fine to have her over and offer a cup of tea/biscuits/whatever you're comfortable with, but it's not okay to spend money outside the agreed upon parameters. And her attention needs to be primarily on the DC she's been asked to look after. I'm guessing everything has been pretty easy going up until now and she may have slipped into a very informal mindset, but she's been very unprofessional here.
Or she may not really like it, may think the mother is just using her as childcare for her toddler while the girls play together and she doesn't know how to say no without upsetting someone she assumes is a friend of yours. I would be unhappy with this. You pay for her to be providing oversight and entertainment for your DD and her guest, not for someone else's child. But a lot of people who go into nannying go in thinking of it as playing with kids, rather than a responsible job with duties to you. (Plenty of nannies are very on the ball - I'm not trying to tar them all with the same brush). If it's this sort of situation or you're just not happy with the nanny having anyone over even if it's the mother of one of your DD's friends (and that's perfectly reasonable and normal) then you need to tell her - no guests. Be clear to your nanny she's there to look after your DD and the people you've invited round - not others. Tell her to ask the mother to come back later if she turns up early, not to entertain her in your home. If she seems to think it will be difficult, maybe role play some ways she can say no to people.
If you're going the no hanging out route, tell the mother too so your nanny isn't trying to enforce something out of the blue. Say to the mother that it's only just come to your attention she's often coming round early, bringing her other child, sometimes ordering food etc. and you appreciate she's been asked in etc. but your nanny has been finding it hard to say no, so you're letting her know it's not part of what your nanny's job description nor what you've hired her for and it's not what you want on a play date at your house.
You mention being worried the mother will turn on you and spread untrue rumours. It's always possible. I would guess most people would see through that anyway, but if her DD likes the playdates as much as your DD it's very unlikely and you just can't go through life being held ransom by what ifs.