fix: frontend payment surfaces — SCA wire shapes (explicit token precedence), mock token parity, infinite-loop guard, money display, delete-account re-auth, admin progress UI, mobile touch targets

- new_card_token uses explicit newCardToken ?? verificationToken precedence on every charge surface (BookingFlow, UserPaymentModal, TipPayment, PaymentModal, TillPurchases, account gift-card buy); dead verification_code/consent fields + ScaFallbackConsentDialog removed from payment flows
- mock mints cnon:sca-... tokenize-results and tokenizeWithVerification returns verificationToken:null for new cards (real-SDK parity so save-card works in dev)
- UserPaymentModal infinite /payment-methods fetch loop guarded; formatCurrency(totalPaid) no longer 100x too small
- delete-account dialog collects current_password + fresh 2FA code; admin 'Begin appointment'/'Complete' wired to /admin/bookings/{id}/progress
- mobile: 44px touch targets, active: feedback, TimeSlotPicker 50dvh, dialog close sizing, .no-scrollbar utility, CSP meta, receipt fields escaped
- vitest: policy.ts cross-check + ScaFallbackConsentDialog component tests (svelte project via happy-dom)

frontend/vitest.config.ts

@@ -1,14 +1,47 @@
+import { fileURLToPath, URL } from 'node:url';
+import { svelte } from '@sveltejs/vite-plugin-svelte';
 import { defineConfig } from 'vitest/config';
 
 // Separate from vite.config.ts: SvelteKit warns about a `test` block there, and
-// `vite build`/`vite dev` must never pick up test-only config. Pure-logic tests
-// need no svelte/tailwind plugins — no DOM/jsdom this round.
+// `vite build`/`vite dev` must never pick up test-only config. Two projects:
+//   - 'node': the pure-logic suite — no DOM, no svelte/tailwind plugins
+//     (existing behavior preserved exactly).
+//   - 'svelte-components': DOM-based tests for `*.svelte.test.ts` — happy-dom
+//     + the svelte plugin + the `$lib` alias so real Svelte 5 components mount.
+// extends:true deep-merges array options (include/exclude concatenate across
+// projects), so include/exclude live ONLY in each project, never at the root.
 export default defineConfig({
 	test: {
-		environment: 'node',
-		include: ['src/**/*.test.ts'],
-		exclude: ['**/node_modules/**', '**/*.svelte.test.ts'],
 		restoreMocks: true,
-		unstubEnvs: true
+		unstubEnvs: true,
+		projects: [
+			{
+				extends: true,
+				test: {
+					name: 'node',
+					environment: 'node',
+					include: ['src/**/*.test.ts'],
+					exclude: ['**/node_modules/**', '**/*.svelte.test.ts']
+				}
+			},
+			{
+				extends: true,
+				plugins: [svelte()],
+				resolve: {
+					alias: {
+						$lib: fileURLToPath(new URL('./src/lib', import.meta.url))
+					},
+					// Svelte 5's `mount()` lives in the client build (svelte's
+					// `browser` export condition); vitest's default SSR
+					// resolution would pick the server build and reject mount.
+					conditions: ['browser']
+				},
+				test: {
+					name: 'svelte-components',
+					environment: 'happy-dom',
+					include: ['src/**/*.svelte.test.ts']
+				}
+			}
+		]
 	}
 });