Gift-card rolling expiry, SvelteDate→Date purge, strict DST tests, UTC scan-location + settings legal floor

Gift-card rolling expiry (setting-driven, was dead config):
- GetGiftCardExpiryMonths(): single source of truth (business_settings
  gift_card_expiry_months, fallback 24) shared by payment handlers and the
  CleanupExpiredGiftCards job (was hardcoded 24).
- expiry_date now maintained on ALL 9 gift-card write sites (buy, topup,
  transfer, redeem, terminal payment, refund credit, till) so the refund-time
  guard at refunds.go actually fires. Schema default 12->24 + migration note;
  test-DB seed aligned. Stale "expiry_date IS NULL" test rewritten; new
  expired-card-rejected regression test.

Frontend SvelteDate purge (docs' stated convention, wide):
- All 180+ raw `new SvelteDate(...)` uses across routes/components replaced
  with parseWallClockDate (backend UTC ISO) or new Date (wall-clock
  constructors). SvelteDate imports removed. timeSlots.ts getDayWithOrdinal
  fixed. Zero SvelteDate references remain; svelte-check clean.

Strict timezone/DST testing + QA fixes:
- 8 new hermetic boundary tests: clock.DST transitions (both 2026 folds),
  closing-hours GMT vs BST, booking date-window midnight, refund-tier
  elapsed-time independence, deposit-window UTC-instant, scheduling
  LondonDateString midnight, today AT TIME ZONE window + UTC round-trip.
- today.go summary date labels fixed to London wall-clock (were showing the
  previous UTC day during BST) + regression test.
- pgx ScanLocation fixed to UTC via AfterConnect (was host-local -> JSON
  offsets depended on deployment TZ, contradicting the documented UTC
  invariant) + regression test. Registered as a new *Type to avoid a data
  race on the shared type map (caught by -race).

Admin Business Settings (setting now functional => legal floor):
- gift_card_expiry_months validation floor raised 1 -> 12 months (CMA/
  Consumer Rights Act 2015 unfair-contract-term guidance) in endpoint + UI,
  with rolling-expiry semantics shown in both display and edit form.
- 3 new expiry validation tests; 2 pre-existing message assertions updated.

Full suite 25/25 + race clean via run-tests.sh lockfile; svelte-check 0
errors/warnings; production build succeeds.

backend/testutils/testdb/testdb.go

@@ -251,7 +251,7 @@ func SeedBaseline(pool *pgxpool.Pool) {
 	// Business settings: required by admin/settings tests and booking deposit logic.
 	_, err := pool.Exec(ctx, `
 		INSERT INTO business_settings (business_name, business_address, currency_code, gift_card_expiry_months, voucher_type)
-		VALUES ('Test Salon', '123 Test St', 'GBP', 12, 'SPV')
+		VALUES ('Test Salon', '123 Test St', 'GBP', 24, 'SPV')
 		ON CONFLICT DO NOTHING
 	`)
 	if err != nil {
@@ -292,7 +292,7 @@ func SeedBaselineScheduling(pool *pgxpool.Pool) {
 	// Business settings same as baseline.
 	_, err := pool.Exec(ctx, `
 		INSERT INTO business_settings (business_name, business_address, currency_code, gift_card_expiry_months, voucher_type)
-		VALUES ('Test Salon', '123 Test St', 'GBP', 12, 'SPV')
+		VALUES ('Test Salon', '123 Test St', 'GBP', 24, 'SPV')
 		ON CONFLICT DO NOTHING
 	`)
 	if err != nil {