fix: admin-scoped 2FA mint targets the CUSTOMER — user authentication for saved cards, never the admin

The till and admin payment modal 'Request a new code' buttons previously called
the session-scoped POST /api/user/2fa/code, which mints a code for the ADMIN's
session — a code that can never satisfy the card-owner gate and is delivered to
the admin's log line, not the customer.

- New POST /api/admin/users/{id}/2fa/code (AdminSendVerificationCodeHandler,
  RequireAdmin + per-user limiter): mints/reuses a code for the TARGET user
  (the card owner/customer), keyed to the CUSTOMER's userID so the [2FA]
  delivery log carries the customer's ID — the customer, never the admin, is
  the authentication subject for their card
- Shared useTwoFactorCodeForSavedCard composable gains an optional mint()
  option; admin surfaces (PaymentModal, TillPurchases) pass the customer-scoped
  mint, customer surfaces keep the session default
- Frontend: adminRequestNewTwoFactorCode(userID) in square.ts; PaymentModal
  mints for booking.user_id, TillPurchases for selectedCustomer.id
- Tests: admin mint keys the code to the customer's userID (log line contains
  customer ID, NOT the admin ID) + pending hash persisted for the customer;
  unknown target user 404s

Backend 26/26 packages; frontend 72/72 + build clean.

backend/main.go

@@ -764,6 +764,11 @@ func main() {
 				r.Get("/{id}/giftcard-balance", payments.GetUserGiftCardBalanceAdmin)
 				r.Get("/{id}/payment-methods", payments.AdminGetUserPaymentMethods)
 				r.Post("/{id}/2fa/remove", user.AdminRemoveUser2FAHandler)
+				// Admin-scoped 2FA mint: the operator requests a code FOR the
+				// customer whose saved card is being charged at the till/admin
+				// payment modal. Mints keyed to the CUSTOMER so the code is
+				// delivered to the customer and can satisfy the card-owner gate.
+				r.With(mw.RateLimitByUser(10, time.Minute)).Post("/{id}/2fa/code", user.AdminSendVerificationCodeHandler)
 			})
 
 			r.Route("/admin/today", func(r chi.Router) {