fix: dav prod-tag test panic (DB init in package init), README SPV-only VAT claim

Quick wins from the Loop B close-out:
- backend/internal/dav/service_prod.go: package-level init() connected to
  postgres and panicked when the DB was unreachable — breaking bare-shell
  'go test -tags test,!dev' and any CI test-prod run without a live service.
  init() now skips connecting under GO_TESTING (the pipeline sets it) or
  DAV_SKIP_INIT, and defaults POSTGRES_HOST to 127.0.0.1 (the pipeline
  postgres-service address, matching testutils/testdb) so real prod builds
  still connect. The test suite wires its own pool in TestMain.
- README.md:21: corrected stale 'Gift card SPV/MPV VAT treatment configurable'
  to the SPV-only posture (a stored MPV is overridden to SPV at read time).

Verified: 26/26 dev packages, both vet tags clean.

README.md

@@ -18,7 +18,7 @@ Nail salon booking platform — Go 1.26.5 backend + SvelteKit 5 SPA + PostgreSQL
 
 **Loyalty & Discounts**: 1 stamp per paid appointment (max 1/day). 10 stamps → 10% off via opt-in checkbox at payment or till. Stamps refunded on cancellation. Campaigns auto-apply at both payment and completion: time-based, per-user milestone, global milestone (in-person only), anniversary. All discounts stack additively against original total. Discount payment records excluded from refund calculations.
 
-**Compliance**: GDPR Article 15 data export (async, 12h cache, 23-section JSON + PDF — excludes verification codes as authentication tokens). Account deletion with external system scrubbing (S3, Square). Guest PII anonymized 6 months post-appointment. UK financial data retention (7 years). Gift card SPV/MPV VAT treatment configurable.
+**Compliance**: GDPR Article 15 data export (async, 12h cache, 23-section JSON + PDF — excludes verification codes as authentication tokens). Account deletion with external system scrubbing (S3, Square). Guest PII anonymized 6 months post-appointment. UK financial data retention (7 years). Gift card VAT treated as single-purpose vouchers (SPV at purchase; a stored MPV setting is overridden to SPV at read time).
 
 **Frontend**: Portfolio gallery with fuzzy tag search (relevance-sorted) and exact category filters (date-sorted), multi-format images (AVIF/WebP/JPEG/JXL with WASM client-side encoding), cursor-based pagination. MapLibre GL map on contact page. PhoneInput component with UK validation. CharCounter for long notes.
 

backend/internal/dav/service_prod.go

@@ -13,21 +13,26 @@ import (
 var Service *BaseService
 
 func init() {
+	// Test builds wire their own pool in TestMain (testutils/testdb) — a real
+	// connect here would race that and panic a bare-shell `go test`. Skip.
+	if os.Getenv("GO_TESTING") != "" || os.Getenv("DAV_SKIP_INIT") != "" {
+		return
+	}
 	if err := connect(); err != nil {
-		// Don't fatal in test mode - tests will use testdb instead
-		if os.Getenv("DAV_SKIP_INIT") != "" {
-			return
-		}
 		panic("failed to initialize prod service: " + err.Error())
 	}
 }
 
 func connect() error {
+	host := getEnv("POSTGRES_HOST")
+	if host == "" {
+		host = "127.0.0.1" // pipeline postgres service default
+	}
 	dsn := fmt.Sprintf(
 		"postgres://%s:%s@%s:5432/%s?timezone=UTC&require_auth=scram-sha-256",
 		getEnv("POSTGRES_USER"),
 		getEnv("POSTGRES_PASSWORD"),
-		getEnv("POSTGRES_HOST"),
+		host,
 		getEnv("POSTGRES_DB"),
 	)
 	pool, err := pgxpool.New(context.Background(), dsn)