Gift-card rolling expiry, SvelteDate→Date purge, strict DST tests, UTC scan-location + settings legal floor

Gift-card rolling expiry (setting-driven, was dead config):
- GetGiftCardExpiryMonths(): single source of truth (business_settings
  gift_card_expiry_months, fallback 24) shared by payment handlers and the
  CleanupExpiredGiftCards job (was hardcoded 24).
- expiry_date now maintained on ALL 9 gift-card write sites (buy, topup,
  transfer, redeem, terminal payment, refund credit, till) so the refund-time
  guard at refunds.go actually fires. Schema default 12->24 + migration note;
  test-DB seed aligned. Stale "expiry_date IS NULL" test rewritten; new
  expired-card-rejected regression test.

Frontend SvelteDate purge (docs' stated convention, wide):
- All 180+ raw `new SvelteDate(...)` uses across routes/components replaced
  with parseWallClockDate (backend UTC ISO) or new Date (wall-clock
  constructors). SvelteDate imports removed. timeSlots.ts getDayWithOrdinal
  fixed. Zero SvelteDate references remain; svelte-check clean.

Strict timezone/DST testing + QA fixes:
- 8 new hermetic boundary tests: clock.DST transitions (both 2026 folds),
  closing-hours GMT vs BST, booking date-window midnight, refund-tier
  elapsed-time independence, deposit-window UTC-instant, scheduling
  LondonDateString midnight, today AT TIME ZONE window + UTC round-trip.
- today.go summary date labels fixed to London wall-clock (were showing the
  previous UTC day during BST) + regression test.
- pgx ScanLocation fixed to UTC via AfterConnect (was host-local -> JSON
  offsets depended on deployment TZ, contradicting the documented UTC
  invariant) + regression test. Registered as a new *Type to avoid a data
  race on the shared type map (caught by -race).

Admin Business Settings (setting now functional => legal floor):
- gift_card_expiry_months validation floor raised 1 -> 12 months (CMA/
  Consumer Rights Act 2015 unfair-contract-term guidance) in endpoint + UI,
  with rolling-expiry semantics shown in both display and edit form.
- 3 new expiry validation tests; 2 pre-existing message assertions updated.

Full suite 25/25 + race clean via run-tests.sh lockfile; svelte-check 0
errors/warnings; production build succeeds.

backend/handlers/payments/refunds.go

@@ -283,6 +283,11 @@ func ProcessCancellationRefundTx(
 				log.Printf("Giftcard payment %s has no gift_card_id — cannot refund to card. Skipping.", paymentID)
 				break
 			}
+			// expiry_date is maintained by EVERY gift-card write that counts as
+			// a "use" (balance check, top-up, transfer, redeem, payment, refund
+			// credit), so a non-NULL expiry_date means the rolling timer is
+			// authoritative. NULL semantics stay fail-open: an unset expiry_date
+			// cannot prove the card is expired, so the refund proceeds.
 			var expired bool
 			if err := tx.QueryRow(ctx, `
 				SELECT expiry_date IS NOT NULL AND expiry_date < NOW()
@@ -293,10 +298,17 @@ func ProcessCancellationRefundTx(
 				log.Printf("Gift card %s has expired — money retained by salon, no refund due for booking %s", *giftCardID, bookingID)
 				break
 			}
+			// Refunding to the card is a "use" per the rolling-expiry terms —
+			// reset the timer at the same moment the balance is credited.
+			gcExpiryMonths, expiryErr := GetGiftCardExpiryMonths(ctx, tx)
+			if expiryErr != nil {
+				log.Printf("Failed to query gift card expiry months (using default %d): %v", defaultGiftCardExpiryMonths, expiryErr)
+				gcExpiryMonths = defaultGiftCardExpiryMonths
+			}
 			if _, err := tx.Exec(ctx, `
-				UPDATE gift_cards SET amount_remaining = amount_remaining + $1, last_used_at = NOW()
+				UPDATE gift_cards SET amount_remaining = amount_remaining + $1, last_used_at = NOW(), expiry_date = NOW() + ($3 * INTERVAL '1 month')
 				WHERE id = $2
-			`, refundThisPayment, *giftCardID); err != nil {
+			`, refundThisPayment, *giftCardID, gcExpiryMonths); err != nil {
 				log.Printf("Failed to refund £%.2f to gift card %s: %v", refundThisPayment, *giftCardID, err)
 				break
 			}