fix: pre-launch review — security, money safety, privacy, legal, code quality

Security (P0):
- IsJTIRevoked fails closed on DB error (previously accepted revoked tokens)
- Remove dead consume parameter from SCA gate (prevented token replay)
- Rate limiter map TTL-based eviction (prevented memory exhaustion)
- 2FA attempt map already had LRU eviction (verified)

Money Safety (P1):
- Gift card transfer refuses expired destination cards
- Gift card balance deduction has WHERE balance >= amount guard
- Webhook clawback acquires till-sale advisory lock
- Sweep/retry lock keys aligned

Privacy/Cookies (P2):
- Self-host Google Fonts (Playfair Display woff2)
- Replace CARTO map tiles with OpenStreetMap raster tiles
- Replace Wikimedia/icon-icons external images with local SVGs
- Remove external image URLs from CSP

Legal (P3):
- Privacy policy: add 6 missing data categories (gift cards, 2FA, GDPR, notifications, technical, cookies)
- Terms: add Tips section (optionality, non-refundable, same processing as bookings)

Code Quality (P4):
- twofa.Check accepts db.Querier for testability
- depositPromotionMinPct uses literal 0.20 (not misleading alias)
- HolidayHours.svelte uses proper type (not as any[])
- Remove stale TODO comments from main.go

Testing (P5):
- 94 new float64 money validity tests across 3 test files
- Cover VAT, splits, refunds, gift cards, rounding, precision boundaries
- All 27 backend test packages pass

frontend/static/images/portfolio/placeholder-04.svg

@@ -0,0 +1,17 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 400 300">
+  <defs>
+    <linearGradient id="bg4" x1="0%" y1="0%" x2="100%" y2="100%">
+      <stop offset="0%" stop-color="#f3e5f5"/>
+      <stop offset="100%" stop-color="#ce93d8"/>
+    </linearGradient>
+  </defs>
+  <rect width="400" height="300" fill="url(#bg4)" rx="8"/>
+  <!-- Geometric nail pattern -->
+  <ellipse cx="200" cy="150" rx="50" ry="90" fill="none" stroke="#8e24aa" stroke-width="2" opacity="0.3"/>
+  <ellipse cx="200" cy="150" rx="35" ry="70" fill="none" stroke="#8e24aa" stroke-width="1.5" opacity="0.3"/>
+  <ellipse cx="200" cy="150" rx="20" ry="50" fill="none" stroke="#8e24aa" stroke-width="1" opacity="0.3"/>
+  <!-- Geometric diamond accent -->
+  <polygon points="200,100 215,130 200,160 185,130" fill="#ab47bc" opacity="0.4"/>
+  <polygon points="200,110 208,130 200,150 192,130" fill="#ce93d8" opacity="0.5"/>
+  <text x="200" y="260" text-anchor="middle" fill="#6a1b9a" font-family="Georgia, serif" font-size="14" opacity="0.6">Nail Art — Geometric</text>
+</svg>