fix: round-2 loop-A fresh review (503c326 baseline) — B1 replay cap, A6 discount record, 2FA reissue+cooldown, notification flood, lockout saturation, VAT/refund-status consolidation

Round 2 Loop A fresh money/security/dup-mod review. 23 findings fixed:

MONEY:
- CRITICAL: B1 duplicate auto-refund gains an attempt cap (b1_attempts col, cap 3) —
  a rejected auto-refund no longer re-replays the expired key every sweep run
  (which minted a stacking unauthorized charge each time); FAILED-webhook
  demotion respects the cap; never re-replay a key whose B1 refund failed
- HIGH: A6 deposit_covered_by_discount skip path now APPLIES the eligible
  campaign discount rows immediately (capped) instead of skipping with no
  discount recorded — no more promised-discount-not-recorded overcharge
- MEDIUM: 2FA code burned by the SAVE gate is re-issued on failed
  new-card+save_card charges (re-issue guard now covers req.SaveCard)
- LOW: GetBookingPaymentSummary excludes tip rows from paidAmount (remaining
  now matches the authoritative tip-excluded balance)

SECURITY:
- MEDIUM: unacknowledged CRITICAL admin-notification flood capped (global cap
  on critical_payment_log + refresh_token_reuse rows)
- MEDIUM: 2FA reissue no longer bypasses the mint cooldown (Check no longer
  clears LastMintAt on gate-verify; cleared on terminal charge success)
- MEDIUM: twofa.StateFor map-saturation returns a shared permanently-locked
  state instead of a fresh 5-guess budget per request
- MEDIUM: ProgressiveRateLimit rejects 429 past maxProgressiveSleepDelayMs
  instead of sleeping unboundedly; login bcrypt concurrency semaphore added
- LOW: loginInProgress 409->429; webhook key-set/URL-unset startup check;
  email-verification per-user attempt counter

DUP/MOD:
- formatCurrency single source (frontend format.ts, 7 files consolidated);
  SquareRefundStatusToLocal single source (errors.go, all sites); admin
  audit-log helper dedup; SCA retry model unified (proactive on all 6
  surfaces); buyDailyTotal/daily-cap mirror via backend; lock TTL from
  backend; generateUUID at all card-form sites; magic numbers named
  (defaultPostgresHost, epsilon, fee constants); admin CASH + gift-card
  terminal charges now audited; DAV_SKIP_INIT documented in manuals

Verified: 26/26 dev + 24/24 prod (GO_TESTING=1, the CI condition), both vet
tags, frontend tests+build, env-docs 42/42.

backend/mw/ratelimit.go

@@ -102,12 +102,28 @@ func (prl *ProgressiveRateLimiter) Check(ip string) (delayMs int) {
 	}
 }
 
+// maxProgressiveSleepDelayMs is the largest delay the progressive per-IP
+// limiter still absorbs by sleeping. Beyond it the request is rejected 429
+// immediately instead (Round 2 Loop A finding 4a): sleeping 5-10s ties up a
+// goroutine per throttled request while the client keeps hammering, so one
+// client can stack many sleeping goroutines in front of the bcrypt wall on
+// /login and /register. The small progressive tiers (500ms / 2s) are
+// unchanged.
+const maxProgressiveSleepDelayMs = 2000
+
 func ProgressiveRateLimit(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		ip := clientIP(r)
 
 		delay := globalProgressiveLimiter.Check(ip)
-		if delay > 0 {
+		switch {
+		case delay > maxProgressiveSleepDelayMs:
+			// Far past the sustained budget — reject now instead of parking a
+			// goroutine for 5-10s. The rejection is a clean 429; the client
+			// retries after the burst window lapses.
+			RespondJSON(w, http.StatusTooManyRequests, map[string]string{"error": "Rate limit exceeded"})
+			return
+		case delay > 0:
 			time.Sleep(time.Duration(delay) * time.Millisecond)
 			w.Header().Set("X-RateLimit-Delay", fmt.Sprintf("%d", delay))
 		}