Gift-card rolling expiry, SvelteDate→Date purge, strict DST tests, UTC scan-location + settings legal floor

Gift-card rolling expiry (setting-driven, was dead config):
- GetGiftCardExpiryMonths(): single source of truth (business_settings
  gift_card_expiry_months, fallback 24) shared by payment handlers and the
  CleanupExpiredGiftCards job (was hardcoded 24).
- expiry_date now maintained on ALL 9 gift-card write sites (buy, topup,
  transfer, redeem, terminal payment, refund credit, till) so the refund-time
  guard at refunds.go actually fires. Schema default 12->24 + migration note;
  test-DB seed aligned. Stale "expiry_date IS NULL" test rewritten; new
  expired-card-rejected regression test.

Frontend SvelteDate purge (docs' stated convention, wide):
- All 180+ raw `new SvelteDate(...)` uses across routes/components replaced
  with parseWallClockDate (backend UTC ISO) or new Date (wall-clock
  constructors). SvelteDate imports removed. timeSlots.ts getDayWithOrdinal
  fixed. Zero SvelteDate references remain; svelte-check clean.

Strict timezone/DST testing + QA fixes:
- 8 new hermetic boundary tests: clock.DST transitions (both 2026 folds),
  closing-hours GMT vs BST, booking date-window midnight, refund-tier
  elapsed-time independence, deposit-window UTC-instant, scheduling
  LondonDateString midnight, today AT TIME ZONE window + UTC round-trip.
- today.go summary date labels fixed to London wall-clock (were showing the
  previous UTC day during BST) + regression test.
- pgx ScanLocation fixed to UTC via AfterConnect (was host-local -> JSON
  offsets depended on deployment TZ, contradicting the documented UTC
  invariant) + regression test. Registered as a new *Type to avoid a data
  race on the shared type map (caught by -race).

Admin Business Settings (setting now functional => legal floor):
- gift_card_expiry_months validation floor raised 1 -> 12 months (CMA/
  Consumer Rights Act 2015 unfair-contract-term guidance) in endpoint + UI,
  with rolling-expiry semantics shown in both display and edit form.
- 3 new expiry validation tests; 2 pre-existing message assertions updated.

Full suite 25/25 + race clean via run-tests.sh lockfile; svelte-check 0
errors/warnings; production build succeeds.

backend/db/db.go

@@ -6,7 +6,10 @@ import (
 	"context"
 	"fmt"
 	"os"
+	"time"
 
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgtype"
 	"github.com/jackc/pgx/v5/pgxpool"
 )
 
@@ -27,6 +30,27 @@ func Connect() error {
 		return err
 	}
 	poolCfg.ConnConfig.RuntimeParams["timezone"] = "UTC"
+	// Scan TIMESTAMPTZ into time.Time in UTC, never the host's local timezone.
+	// Without this, pgx scans into time.Local, so the JSON offset in API
+	// responses silently depends on the deployment host's TZ (e.g. +01:00 on a
+	// London host, Z on a UTC Docker host) — the instant is the same but the
+	// documented "backend emits UTC" invariant would be violated.
+	// The codec is registered as a NEW *Type rather than mutating the Type
+	// returned by TypeForOID: every connection's type map shares the same
+	// *Type pointers with the package default map, so mutating .Codec on the
+	// shared Type would be a data race when concurrent connections establish.
+	poolCfg.AfterConnect = func(_ context.Context, conn *pgx.Conn) error {
+		tzType, ok := conn.TypeMap().TypeForOID(pgtype.TimestamptzOID)
+		if !ok {
+			return nil
+		}
+		conn.TypeMap().RegisterType(&pgtype.Type{
+			Codec: &pgtype.TimestamptzCodec{ScanLocation: time.UTC},
+			Name:  tzType.Name,
+			OID:   tzType.OID,
+		})
+		return nil
+	}
 	pool, err := pgxpool.NewWithConfig(context.Background(), poolCfg)
 	if err != nil {
 		return err

backend/db/db_dev.go

@@ -6,7 +6,10 @@ import (
 	"context"
 	"fmt"
 	"os"
+	"time"
 
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgtype"
 	"github.com/jackc/pgx/v5/pgxpool"
 )
 
@@ -27,6 +30,27 @@ func Connect() error {
 		return err
 	}
 	poolCfg.ConnConfig.RuntimeParams["timezone"] = "UTC"
+	// Scan TIMESTAMPTZ into time.Time in UTC, never the host's local timezone.
+	// Without this, pgx scans into time.Local, so the JSON offset in API
+	// responses silently depends on the deployment host's TZ (e.g. +01:00 on a
+	// London host, Z on a UTC Docker host) — the instant is the same but the
+	// documented "backend emits UTC" invariant would be violated.
+	// The codec is registered as a NEW *Type rather than mutating the Type
+	// returned by TypeForOID: every connection's type map shares the same
+	// *Type pointers with the package default map, so mutating .Codec on the
+	// shared Type would be a data race when concurrent connections establish.
+	poolCfg.AfterConnect = func(_ context.Context, conn *pgx.Conn) error {
+		tzType, ok := conn.TypeMap().TypeForOID(pgtype.TimestamptzOID)
+		if !ok {
+			return nil
+		}
+		conn.TypeMap().RegisterType(&pgtype.Type{
+			Codec: &pgtype.TimestamptzCodec{ScanLocation: time.UTC},
+			Name:  tzType.Name,
+			OID:   tzType.OID,
+		})
+		return nil
+	}
 	pool, err := pgxpool.NewWithConfig(context.Background(), poolCfg)
 	if err != nil {
 		return err

backend/db/db_test.go

@@ -8,6 +8,7 @@ import (
 	"os"
 	"sync"
 	"testing"
+	"time"
 )
 
 func resetEnv() {
@@ -71,6 +72,42 @@ func TestConnect_PingViaTestDB(t *testing.T) {
 	}
 }
 
+// TestScanLocation_UTC proves the AfterConnect hook: TIMESTAMPTZ values are
+// scanned into time.Time in UTC, never the host's local timezone. Without the
+// hook, pgx scans into time.Local, so a London-host dev server would emit
+// +01:00 JSON offsets while a UTC Docker host emits Z — same instant, but the
+// documented "backend emits UTC" invariant would silently depend on the
+// deployment host's TZ.
+func TestScanLocation_UTC(t *testing.T) {
+	closePool()
+	resetEnv()
+
+	err := Connect()
+	if err != nil {
+		t.Fatalf("Connect() failed: %v", err)
+	}
+	defer closePool()
+
+	poolConn, err := Conn.Acquire(context.Background())
+	if err != nil {
+		t.Fatalf("Acquire failed: %v", err)
+	}
+	defer poolConn.Release()
+
+	// A known instant: 2026-06-15 00:30 BST = 2026-06-14 23:30 UTC.
+	instant := time.Date(2026, 6, 14, 23, 30, 0, 0, time.UTC)
+	var scanned time.Time
+	if err := poolConn.QueryRow(context.Background(), "SELECT $1::timestamptz", instant).Scan(&scanned); err != nil {
+		t.Fatalf("timestamptz scan failed: %v", err)
+	}
+	if !scanned.Equal(instant) {
+		t.Errorf("scanned instant = %s, expected %s", scanned.Format(time.RFC3339Nano), instant.Format(time.RFC3339Nano))
+	}
+	if scanned.Location() != time.UTC {
+		t.Errorf("scanned time.Time location = %v, expected time.UTC (host TZ is %v)", scanned.Location(), time.Local)
+	}
+}
+
 // =============================================================================
 // Connection failure scenarios
 // =============================================================================