Gift-card rolling expiry, SvelteDate→Date purge, strict DST tests, UTC scan-location + settings legal floor

Gift-card rolling expiry (setting-driven, was dead config):
- GetGiftCardExpiryMonths(): single source of truth (business_settings
  gift_card_expiry_months, fallback 24) shared by payment handlers and the
  CleanupExpiredGiftCards job (was hardcoded 24).
- expiry_date now maintained on ALL 9 gift-card write sites (buy, topup,
  transfer, redeem, terminal payment, refund credit, till) so the refund-time
  guard at refunds.go actually fires. Schema default 12->24 + migration note;
  test-DB seed aligned. Stale "expiry_date IS NULL" test rewritten; new
  expired-card-rejected regression test.

Frontend SvelteDate purge (docs' stated convention, wide):
- All 180+ raw `new SvelteDate(...)` uses across routes/components replaced
  with parseWallClockDate (backend UTC ISO) or new Date (wall-clock
  constructors). SvelteDate imports removed. timeSlots.ts getDayWithOrdinal
  fixed. Zero SvelteDate references remain; svelte-check clean.

Strict timezone/DST testing + QA fixes:
- 8 new hermetic boundary tests: clock.DST transitions (both 2026 folds),
  closing-hours GMT vs BST, booking date-window midnight, refund-tier
  elapsed-time independence, deposit-window UTC-instant, scheduling
  LondonDateString midnight, today AT TIME ZONE window + UTC round-trip.
- today.go summary date labels fixed to London wall-clock (were showing the
  previous UTC day during BST) + regression test.
- pgx ScanLocation fixed to UTC via AfterConnect (was host-local -> JSON
  offsets depended on deployment TZ, contradicting the documented UTC
  invariant) + regression test. Registered as a new *Type to avoid a data
  race on the shared type map (caught by -race).

Admin Business Settings (setting now functional => legal floor):
- gift_card_expiry_months validation floor raised 1 -> 12 months (CMA/
  Consumer Rights Act 2015 unfair-contract-term guidance) in endpoint + UI,
  with rolling-expiry semantics shown in both display and edit form.
- 3 new expiry validation tests; 2 pre-existing message assertions updated.

Full suite 25/25 + race clean via run-tests.sh lockfile; svelte-check 0
errors/warnings; production build succeeds.

frontend/src/lib/components/admin/EditBookingModal.svelte

@@ -1,6 +1,5 @@
 <script lang="ts">
 	import { apiFetch } from '$lib/utils/api';
-	import { SvelteDate } from 'svelte/reactivity';
 	import { toast } from 'svelte-sonner';
 	import { extractErrorMessage } from '$lib/utils/toast-safe';
 	import { formatDuration } from '$lib/utils/format';
@@ -280,10 +279,10 @@
 	const maxAvailableDuration = $derived.by(() => {
 		if (!booking?.start_time || !nextAppointmentStart) return null;
 
-		const bookingStart = new SvelteDate(booking.start_time).getTime();
+		const bookingStart = parseWallClockDate(booking.start_time).getTime();
 		const currentDurationMs = totalDuration * 60 * 1000;
 		const bookingEnd = bookingStart + currentDurationMs;
-		const nextStart = new SvelteDate(nextAppointmentStart).getTime();
+		const nextStart = parseWallClockDate(nextAppointmentStart).getTime();
 
 		const availableMs = nextStart - bookingEnd;
 		return Math.max(0, Math.floor(availableMs / (60 * 1000)));
@@ -600,7 +599,7 @@
 											{/if}
 										</div>
 										<div class="mt-1 text-xs text-gray-400">
-											{new SvelteDate(payment.created_at).toLocaleDateString('en-GB', {
+											{parseWallClockDate(payment.created_at).toLocaleDateString('en-GB', {
 												day: 'numeric',
 												month: 'short',
 												year: 'numeric'