Fix review findings: expiry bug (all 8 files), idempotency keys, card_expiry/card_cvc removal, URL encoding, BuyerEmail logging, ValidateCardInfo, saved-card test, future work doc

Backend:
- Fix refund idempotency key: clock.Now() → deterministic (pr.ID + amount)
- Fix ValidateCardInfo: enforce mutual exclusivity, handle empty strings symmetrically
- Fix paymentFromSquare brand fallback (remove dead SourceType fallback)
- Fix URL encoding: PathEscape → QueryEscape for customer_id query param
- Fix BuyerEmail: log warning on DB error instead of silent discard
- Fix idempotency key in createCardOnFileHTTP: time.Now() → deterministic hex hash
- Add BuyerEmail to CreateTipPayment Square request
- Move realBaseURL from shared file to square_dev.go (only used in dev)
- Add TestTipPayment_WithSavedCard test (card_id path coverage)
- Fix AMEX brand in mock (AMEX → AMERICAN_EXPRESS, fix test)

Frontend:
- Fix off-by-month expiry bug in ALL 8 files using year-month arithmetic
  (parseExpiryParts returns 1-indexed, SvelteDate expects 0-indexed)
  Files: tip/+page, pay-tip/[id], UserBookingModal, UserPaymentModal,
  BookingFlow, account/+page (add card + buy gift card sections)
- Remove card_expiry/card_cvc from tip request bodies (backend has no fields)

Docs:
- Mark P9 (placeholder tokens) as completed, add P11 (Square Web Payments SDK)
- Mark T13 (rune arithmetic) as completed

backend/handlers/payments/validators.go

@@ -53,9 +53,15 @@ func ValidateRefundReason(reason string) error {
 	return nil
 }
 
-// ValidateCardInfo checks that at least one of cardID or newCardToken is provided
+// ValidateCardInfo checks that exactly one of cardID or newCardToken is provided,
+// non-nil, and non-empty.
 func ValidateCardInfo(cardID, newCardToken *string) error {
-	if cardID == nil && (newCardToken == nil || *newCardToken == "") {
+	hasCardID := cardID != nil && *cardID != ""
+	hasToken := newCardToken != nil && *newCardToken != ""
+	if hasCardID && hasToken {
+		return errors.New("provide either card_id or new_card_token, not both")
+	}
+	if !hasCardID && !hasToken {
 		return errors.New("either card_id or new_card_token is required")
 	}
 	return nil