docs: round 5 — accurate test counts, correct 2FA disable semantics, document residual lockout risk

Fifth fresh-eyes review pass (5 agents: goal, QA, code-quality, security,
context-mining). Code verdict: PASS across all five. The findings this round
were documentation-only — the code changes from round 4 (per-dispute chargeback
alerting, single-source clawback, 2FA lockout coherence) were verified correct.

Docs:
- Test counts corrected everywhere to the ACTUAL compiled number under
  -tags test,dev: 2,137 (README, Technical Manual, Testing Architecture doc).
  Prior docs claimed 2,151 / 2,133 — neither matched the compiled count, and
  the raw func-Test grep (2,154) includes 17 build-tag-excluded tests.
- Technical Manual 2FA Gate: corrected the false 'fresh verification code is
  generated ... when disabling' claim. The disable flow REUSES a still-valid
  pending code and only mints fresh when none exists; the 'always-fresh on
  disable' alternative was deliberately NOT adopted (an out-of-band [2FA]-log
  code cannot be submitted within the same request that generates it). This
  now matches the code and the round-4 commit's own rationale.
- Technical Manual: documented the accepted residual 2FA brute-force exposure:
  a fresh-code delivery resets the shared 5-attempt counter, so an attacker
  who already holds the victim's password can loop disable to obtain unlimited
  fresh codes (6-digit guessing bounded only by the per-IP rate limit and
  10-min TTL). Documented rather than fixed because a hard lockout would strand
  a legitimate code-lost user with no email/SMS recovery (P6).
- README: corrected the -count=10 verification claim — handlers/payments and
  handlers/webhooks share package-global state (Square mock ledger, in-memory
  webhook dedup cache, fixed-ID test rows) that leaks across in-process
  iterations, so -count>1 is unreliable there; use -count=1 for those two.

Verification: build clean, user/webhooks/payments packages green via
run-tests.sh, frontend builds, svelte-check 0 errors.

README.md

@@ -89,9 +89,12 @@ Default logins (password: `password`):
 ```bash
 cd backend && go build -o bin/backend ./main.go
 cd frontend && npm ci && npm run build
-cd backend && go test -tags "test,dev" -count=1 -parallel 8 ./...   # 2,151 tests passed (4 skipped, ~2min)
+cd backend && go test -tags "test,dev" -count=1 -parallel 8 ./...   # 2,137 tests compiled under the test,dev tags (~2min)
 cd backend && go test -tags "test,dev" -count=1 -race -timeout 480s ./...  # race detector (all packages, ~4min)
-cd backend && go test -tags "test,dev" -count=10 -parallel 8 ./...  # thorough verification (~2-3min)
+# NOTE: -count=N>1 is unreliable for handlers/payments and handlers/webhooks —
+# those suites share package-global state (Square mock ledger, in-memory webhook
+# dedup cache, fixed-ID test rows) that leaks across in-process iterations.
+# Use -count=1 there; -count=N works for the other packages.
 ```
 
 ### Pre-commit hooks