Square payment integration: real HTTP client, tip flow rewrite, card UI/validation overhaul

Backend:
- Create square_http_client.go: real Square REST API client (Payments, Terminal Checkouts, Refunds, Cards, Locations) with proper JSON types, auth, error handling
- Update ProdClient in square.go to delegate to shared HTTP functions
- Wire devProdClient in square_dev.go to also make real HTTP calls for sandbox/prod env
- Rewrite CreateTipPayment handler: accept card_id OR new_card_token (+save_card), advisory lock, idempotency check, max amount validation
- Add ValidateCardInfo, bump ValidateAmount max to £10,000
- Fix mock CreateCardOnFile to detect brand/last4 from raw card numbers
- Fix mock RefundPayment to index by SquarePayID and accept unknown payment IDs
- Remove dead types (ProcessingFee, sqAddress), add Deadline parity
- Fix AMEX brand inconsistency (AMEX -> AMERICAN_EXPRESS)
- Pre-existing fix: remove unused context import in giftcards.go

Frontend:
- CardInput.svelte: add onfieldblur/onfieldinput callbacks for blur-based validation
- CardBrandIcon.svelte: brand SVGs for VISA, MC, AMEX, Discover, Diners, JCB, Square Gift Card, UnionPay, Interac, EFTPOS
- tip/+page, pay-tip/[id], UserBookingModal tip: saved card list + CardInput + Luhn/expiry/CVC validation + blur-based errors + no-saved-cards edge case
- UserPaymentModal, BookingFlow: card validation parity (blur-based, all-valid check)
- account page: replace text brand badges with CardBrandIcon
- Fix handleCustomTip bug (state mutations outside if block)
- Remove dead pageState variable
- Add tip modal scroll (max-h-[90vh] overflow-y-auto)
- Submit button disabled on !isCardValid

Tests:
- 30 square package tests (+new: CreateCardOnFile raw number path, detectCardInfo variants)
- 5 tip handler tests (HappyPath, NoPriorPayment, WrongOwner, MultipleTips, TxFailure)
- All +-race clean, refund tests fixed

frontend/src/lib/components/booking/BookingFlow.svelte

@@ -99,9 +99,56 @@
 	let newCardNumber = $state('');
 	let newCardExpiry = $state('');
 	let newCardCVC = $state('');
+	let cardNumberTouched = $state(false);
+	let cardExpiryTouched = $state(false);
+	let cardCVCTouched = $state(false);
+
+	function parseExpiryParts(value: string): { month: number; year: number } | null {
+		if (!/^\d{2}\/\d{2}$/.test(value)) return null;
+		const [monthStr, yearStr] = value.split('/');
+		const month = parseInt(monthStr, 10);
+		const year = 2000 + parseInt(yearStr, 10);
+		if (month < 1 || month > 12) return null;
+		return { month, year };
+	}
+
+	function isValidLuhn(cardNumber: string): boolean {
+		const s = cardNumber.replace(/\D/g, '');
+		let sum = 0;
+		let alternate = false;
+		for (let i = s.length - 1; i >= 0; i--) {
+			let n = parseInt(s[i], 10);
+			if (alternate) {
+				n *= 2;
+				if (n > 9) n -= 9;
+			}
+			sum += n;
+			alternate = !alternate;
+		}
+		return sum % 10 === 0 && s.length >= 13 && s.length <= 19;
+	}
+
+	const expiryParts = $derived(parseExpiryParts(newCardExpiry));
+
 	// Payment flow state
 	let depositPaid = $state(false);
 
+	const cardError = $derived(
+		cardNumberTouched && !isValidLuhn(newCardNumber) && newCardNumber.length > 0
+			? 'Invalid card number'
+			: cardExpiryTouched && expiryParts !== null && (() => { const d = new SvelteDate(expiryParts.year, expiryParts.month); return d < new SvelteDate(); })()
+				? 'This card has expired'
+				: cardExpiryTouched && !/^\d{2}\/\d{2}$/.test(newCardExpiry) && newCardExpiry.length > 0
+					? 'Enter expiry as MM/YY'
+					: cardCVCTouched && newCardCVC.length < 3 && newCardCVC.length > 0
+						? 'Enter your CVC number'
+						: isValidLuhn(newCardNumber) && /^\d{2}\/\d{2}$/.test(newCardExpiry) && newCardCVC.length >= 3
+							? null
+							: newCardNumber.length === 0 && newCardExpiry.length === 0 && newCardCVC.length === 0
+								? null
+								: 'Please complete all card fields'
+	);
+
 	const depositCardFormValid = $derived(
 		selectedPaymentMethod !== null ||
 			(showNewCardForm &&
@@ -269,6 +316,18 @@
 		}
 	}
 
+	function handleFieldBlur(field: string) {
+		if (field === 'cardNumber') cardNumberTouched = true;
+		else if (field === 'cardExpiry') cardExpiryTouched = true;
+		else if (field === 'cardCVC') cardCVCTouched = true;
+	}
+
+	function handleFieldInput(field: string) {
+		if (field === 'cardNumber') cardNumberTouched = false;
+		else if (field === 'cardExpiry') cardExpiryTouched = false;
+		else if (field === 'cardCVC') cardCVCTouched = false;
+	}
+
 	async function processPayment(amount: number) {
 		// Synchronous double-click guard — set BEFORE any await so a rapid second
 		// click is rejected immediately, even before the reactive `disabled` has
@@ -2315,7 +2374,12 @@
 									bind:cardExpiry={newCardExpiry}
 									bind:cardCVC={newCardCVC}
 									disabled={isProcessingPayment}
+									onfieldblur={handleFieldBlur}
+									onfieldinput={handleFieldInput}
 								/>
+								{#if cardError}
+									<p class="mt-2 text-sm text-red-600">{cardError}</p>
+								{/if}
 							{/if}
 
 							<div class="flex items-center justify-between border-t pt-4">