fix: restart-loop-A findings — pending sweep refunds, tip carve on discounts, TOCTOU redemption, single-use 2FA code + mint endpoint, refresh-token family revocation, admin 2FA code UX

Restart of Loop A (fresh review -> fix -> verify) findings from commit 5e967fa:
- B1: sweep auto-refund treats Square PENDING refunds as NON-terminal (row stays pending, no gift-card clawback, refunds row inserted for payments AND till_sales, re-polls the deterministic sweepdup- key); Square-less pre-pass exempts square_refund_id IS NOT NULL rows
- M4: terminal tip carve accounts for pending campaign discounts (headroom = total - pending - paid) so explicit tips aren't absorbed as service revenue; no-tip case stays a single record
- max_redemptions TOCTOU closed with atomic conditional UPDATE ... RETURNING; exhausted-at-apply surfaces campaign_fully_redeemed
- 2FA: verification code is single-use on the saved-card gate (VerifyForUser consume=true, interactive flows unaffected); new POST /api/user/2fa/code mints a fresh code for enabled users (RequireAuth + RequireNonGuest + mint cooldown + per-user limiter)
- Refresh tokens: family_id + used_at columns; reuse of an already-rotated token revokes the ENTIRE family and inserts a refresh_token_reuse admin alert; rotation mints descendants in the same family
- Frontend: 2FA code input + Request-a-new-code on all saved-card surfaces; admin modal keys code input to customer 2FA + 403 self-heal; tip-display note for pending discounts; 76 frontend tests
- Verified: all 26 backend packages pass, frontend build+tests green, env-docs 41/41

backend/handlers/auth/auth_test.go

@@ -1781,7 +1781,7 @@ func TestRefreshToken_Generation(t *testing.T) {
 		t.Errorf("expected 1 refresh_token, got %d", count)
 	}
 
-	retrievedUserID, retrievedRole, err := auth.VerifyRefreshToken(ctx, refreshToken)
+	retrievedUserID, retrievedRole, _, err := auth.VerifyRefreshToken(ctx, refreshToken)
 	if err != nil {
 		t.Fatalf("failed to verify refresh token: %v", err)
 	}
@@ -1792,7 +1792,7 @@ func TestRefreshToken_Generation(t *testing.T) {
 		t.Errorf("expected role 'verified_email', got %q", retrievedRole)
 	}
 
-	_, _, err = auth.VerifyRefreshToken(ctx, refreshToken)
+	_, _, _, err = auth.VerifyRefreshToken(ctx, refreshToken)
 	if err == nil {
 		t.Error("expected error on second refresh token verification (rotated)")
 	}
@@ -1942,17 +1942,20 @@ func TestRefreshToken_RotatesRefreshToken_DBBacked(t *testing.T) {
 		t.Fatalf("refresh failed: %d. body: %s", w.Code, w.Body.String())
 	}
 
-	// The used token was deleted (rotated) and a fresh one inserted — the row
-	// count is unchanged at 1, but the consumed token no longer verifies.
+	// Rotation is DB-backed: the presented token was consumed (marked used, so a
+	// replay can be detected and the whole family revoked) and a fresh descendant
+	// minted in the same family. The used row is RETAINED for reuse detection, so
+	// 2 rows now exist for the user (used original + new descendant), and the
+	// consumed token no longer verifies.
 	var after int
 	if err := tx.QueryRow(ctx, "SELECT COUNT(*) FROM refresh_tokens WHERE user_id = $1", userID).Scan(&after); err != nil {
 		t.Fatalf("failed to count refresh tokens after refresh: %v", err)
 	}
-	if after != 1 {
-		t.Errorf("expected exactly 1 refresh token after rotation, got %d", after)
+	if after != 2 {
+		t.Errorf("expected 2 refresh tokens after rotation (used original retained + descendant), got %d", after)
 	}
 
-	if _, _, err := auth.VerifyRefreshToken(ctx, refreshToken); err == nil {
+	if _, _, _, err := auth.VerifyRefreshToken(ctx, refreshToken); err == nil {
 		t.Error("the consumed refresh token must no longer verify (rotated)")
 	}
 }