Fix Square card linkage: reference_id instead of customer_id (no Square customer provisioning)

The app does not provision Square customers, so sending the local user ID as
customer_id in Create Card was rejected with CUSTOMER_NOT_FOUND, and filtering
List Cards by it returned nothing. reference_id is Square's free-form client
reference — max 128 chars, no uniqueness constraint — and is echoed in both
Create and List responses.

- Create Card payload: reference_id = local user ID (customer_id absent)
- List Cards: native ?reference_id=<userID> filter (no limit/customer_id,
  no client-side filter, no cursor handling needed)
- Mock parity: CreateCardOnFile stores ReferenceID; GetCardsOnFile unchanged
- Regression guards: TestCreateCardOnFileHTTP_IdempotencyKey asserts
  reference_id=user_1 and customer_id ABSENT; new
  TestGetCardsOnFileHTTP_ReferenceIDFilter asserts the query shape

backend/internal/square/square_dev.go

@@ -390,7 +390,7 @@ func (m *MockClient) CreateCardOnFile(ctx context.Context, userID, cardToken str
 		ExpYear:        2030,
 		Fingerprint:    fmt.Sprintf("sqfp_mock_%d", now.UnixNano()),
 		CardholderName: "John Doe",
-		CustomerID:     userID,
+		ReferenceID:    userID,
 		Enabled:        true,
 		IsDefault:      len(m.cards[userID]) == 0,
 		Version:        1,