Add dev-only frontend Square mock mode for as-if-live walkthroughs

VITE_SQUARE_ENVIRONMENT=mock renders a plain HTML card form (MockCardForm)
instead of the Square Web Payments SDK iframe, minting the same cnon: tokens
the backend dev mock accepts — all 8 payment flows run end-to-end locally with
zero credentials.

- isSquareMock() gated on import.meta.env.DEV: structurally impossible in a
  production build even if the env var is mis-set
- MockCardForm: Luhn/brand/expiry/CVC validation, Amex 15-digit + 4-digit CVC,
  error states, disabled propagation — mirrors the real form's onReady contract
  so CardSelection.isCardValid and submit guards behave identically
- tokenize() maps typed card -> deterministic cnon: token matching backend
  detectCardInfo (4242->test-card, 4111->visa, 5555->mastercard, 3782->amex)
- lazy-loaded via dynamic import: mock code ships in its own chunk, referenced
  only from the mock branch, never statically imported into the main bundle
- docs: .env.example (mock pairing with SQUARE_ENVIRONMENT=mock), P11 plan
  (mock opt-in + canonical-last4 caveat), Feature Catalog (2.1, 2.5)
- prettier formatting fixes in 10 unrelated files (line wrapping only)

.env.example

@@ -45,10 +45,12 @@ SQUARE_WEBHOOK_NOTIFICATION_URL=
 # Frontend (public — safe for the browser). Square Web Payments SDK:
 # VITE_SQUARE_APPLICATION_ID — client-side application ID (sandbox IDs start with "sandbox-")
 # VITE_SQUARE_LOCATION_ID    — Square location ID
-# VITE_SQUARE_ENVIRONMENT    — 'sandbox' | 'production' (optional; derived from the app ID prefix when omitted)
+# VITE_SQUARE_ENVIRONMENT    — 'mock' | 'sandbox' | 'production'. Local dev: 'mock' renders the
+#                              frontend's built-in mock card form (tokens only; pairs with
+#                              SQUARE_ENVIRONMENT=mock above). NEVER set 'mock' in production.
 VITE_SQUARE_APPLICATION_ID=
 VITE_SQUARE_LOCATION_ID=
-VITE_SQUARE_ENVIRONMENT=
+VITE_SQUARE_ENVIRONMENT=mock
 
 # Test Database (separate from main DB)
 # Used by testutils/testdb for running tests without corrupting dev data