fix: restart-loop-A findings — pending sweep refunds, tip carve on discounts, TOCTOU redemption, single-use 2FA code + mint endpoint, refresh-token family revocation, admin 2FA code UX

Restart of Loop A (fresh review -> fix -> verify) findings from commit 5e967fa:
- B1: sweep auto-refund treats Square PENDING refunds as NON-terminal (row stays pending, no gift-card clawback, refunds row inserted for payments AND till_sales, re-polls the deterministic sweepdup- key); Square-less pre-pass exempts square_refund_id IS NOT NULL rows
- M4: terminal tip carve accounts for pending campaign discounts (headroom = total - pending - paid) so explicit tips aren't absorbed as service revenue; no-tip case stays a single record
- max_redemptions TOCTOU closed with atomic conditional UPDATE ... RETURNING; exhausted-at-apply surfaces campaign_fully_redeemed
- 2FA: verification code is single-use on the saved-card gate (VerifyForUser consume=true, interactive flows unaffected); new POST /api/user/2fa/code mints a fresh code for enabled users (RequireAuth + RequireNonGuest + mint cooldown + per-user limiter)
- Refresh tokens: family_id + used_at columns; reuse of an already-rotated token revokes the ENTIRE family and inserts a refresh_token_reuse admin alert; rotation mints descendants in the same family
- Frontend: 2FA code input + Request-a-new-code on all saved-card surfaces; admin modal keys code input to customer 2FA + 403 self-heal; tip-display note for pending discounts; 76 frontend tests
- Verified: all 26 backend packages pass, frontend build+tests green, env-docs 41/41

backend/main.go

@@ -624,22 +624,29 @@ func main() {
 			// able to reach these, not just verified accounts.
 			r.With(mw.RequireNonGuest).Get("/user/2fa/status", user.GetTwoFAStatusHandler)
 			// The code-issuing/verifying endpoints get a dedicated per-user
-			// limiter (10/min) on top of the group's generic 120/min limiter:
+			// limiter (10/min) on top of the group's generic 120/min per-IP
+			// limiter:
 			// the 6-digit codes live in a 1M space, so a single user must not be
-			// able to hammer setup/verify/disable faster than the per-user
-			// 5-attempt lockout can trip. The key is the authenticated userID
-			// ALONE (RateLimitByUser) — NOT user+IP (B8): with the IP in the
-			// key, a client that can rotate its source IP (or that sits behind
+			// able to hammer setup/verify/disable/code-mint faster than the
+			// per-user 5-attempt lockout can trip. The key is the authenticated
+			// userID ALONE (RateLimitByUser) — NOT user+IP (B8): with the IP in
+			// the key, a client that can rotate its source IP (or that sits behind
 			// a proxy echoing a client-supplied CF-Connecting-IP when
 			// TRUST_PROXY_HEADERS=true) mints a fresh bucket per IP for the
 			// same account, collapsing the per-account budget. One shared
-			// limiter for all four so the whole 2FA surface counts against a
+			// limiter for all five so the whole 2FA surface counts against a
 			// single per-user budget.
 			twoFALimiter := mw.RateLimitByUser(10, time.Minute)
 			r.With(mw.RequireNonGuest, twoFALimiter).Post("/user/2fa/setup", user.SetupTwoFAHandler)
 			r.With(mw.RequireNonGuest, twoFALimiter).Post("/user/2fa/verify", user.VerifyTwoFAHandler)
 			r.With(mw.RequireNonGuest, twoFALimiter).Post("/user/2fa/disable", user.DisableTwoFAHandler)
 			r.With(mw.RequireNonGuest, twoFALimiter).Post("/user/2fa/disable/code", user.SendDisableCodeHandler)
+			// Fresh-code request for an already-ENABLED user making a saved-card
+			// charge (the B6/B10 gate). Setup refuses enabled users (409) and
+			// setup clears the pending code on success, so this is the only mint
+			// path for an enabled user. Same middleware chain + shared limiter as
+			// the rest of the 2FA surface.
+			r.With(mw.RequireNonGuest, twoFALimiter).Post("/user/2fa/code", user.SendVerificationCodeHandler)
 			r.Delete("/user/account", user.DeleteAccountHandler)
 			r.Get("/user/gdpr-export", user.GetGDPRExportHandler)
 			r.Get("/user/loyalty", user.GetLoyaltyHandler)