Implement full Square payment review fixes + frontend polish

Implement every finding from the deep payment review (P0-P2, minors,
nitpicks), then close the post-implementation re-review items, then
align card-form typography and roll out the Square trust badge.

Backend - Square API alignment:
- tip_settings.allow_tipping nested under device_options (was top-level:
  terminal tips were silently lost in prod)
- CreateCardOnFile now accepts customerID and sends card.customer_id;
  saved-card (ccof:) charges forward square_customer_id as CustomerID
- New SquareClient methods GetPayment, CreateCustomer, CancelCheckout
- SCA verification_token accepted + forwarded in all charge paths
- ExpMonth/ExpYear -> *int; URL-path id validation; CancelCheckout
  NOT_FOUND-only no-op (dropped unverified NOOP); exported ErrorCode/
  ErrorDetail helpers; mock rejects raw PANs, RList locks, redacts
  emails, ForceRefundPending hook

Backend - money safety:
- sweepManualPendingSquareRefunds reconciles rows WITH square_refund_id
  instead of stranding them forever
- SweepStalePendingPayments reconciles at Square before failing (tri-state:
  leave pending on transport error, rescue completed, fail definitively)
- GetCheckoutStatus cancellation-recheck; terminal CANCELED resolution;
  SweepStaleTerminalCheckouts covers terminal_checkouts table
- till gift-card clawback on definitive failure incl. retry path +
  INSUFFICIENT_FUNDS/ADDRESS_VERIFICATION_FAILURE/TRANSACTION_LIMIT
- cross-user saved-card collision fixed (UNIQUE(user_id,square_card_id))
- customer provisioning (lazy, save-only); one-off/guest mint no customer
- discount preview/apply unified in discounts.go (global-milestone visible
  in preview, N+1 eliminated, redemption counter preserved on failures)
- webhook event_id dedup; refund loop dedup; stale comment fixes
- test-isolation t.Cleanup on committed sweep tests

Frontend:
- SCA tokenizeWithVerification across all charge flows (amount as
  major-units decimal), 5-min token-expiry re-tokenize, verification_token
  in request bodies
- PaymentModal synchronous double-click + zero/negative-amount guards
- till online-card UI wired to /api/admin/till/sale
- policyPopover generalised; new /privacy-policy route; consent checkbox
  copy + Square privacy link
- Square card iframe styled to app typography (Inter 14px, oklch tokens);
  mock form md:text-sm parity
- 'Secure payment powered by Square' badge on all 8 card-payment flows

Schema/docs: terminal_checkouts + square_customer_id + per-user card
constraint in init-script.sql; README migrations; P14 plan + backlog +
Technical Manual updated.

Includes 39 modified/new test files; full backend suite (25 pkgs),
-race on payments+square, and frontend build are green.

frontend/src/lib/components/payments/UserPaymentModal.svelte

@@ -50,6 +50,15 @@
 	// Cached nonce for the new-card form: tokenization is one-shot, so a retry
 	// reuses this token instead of re-tokenizing (backend idempotency dedups).
 	let newCardNonce = $state('');
+	// Cached SCA verification token paired with newCardNonce (both one-shot,
+	// reused together on retry). The verification token is amount-bound, so a
+	// changed payment amount invalidates the cached pair.
+	let newCardVerificationToken = $state('');
+	let newCardTokenAmount = $state(0);
+	// Epoch ms when the cached pair was tokenized — Square nonces and SCA
+	// verification tokens expire after ~5 minutes, so a stale pair is discarded
+	// on late retries and re-tokenized instead of rejected by Square.
+	let newCardTokenizedAt = $state(0);
 	let paymentResult = $state<{
 		id: string;
 		amount: number;
@@ -356,15 +365,27 @@
 
 		let cardId: string | undefined;
 		let newCardToken: string | undefined;
+		let verificationToken: string | undefined;
 
 		if (selectedCardId) {
 			cardId = selectedCardId;
 		} else if (cardSelection) {
-			// New-card mode: tokenize once per attempt, then reuse the cached nonce
-			// on retry (tokenization is one-shot; the backend idempotency key dedups).
-			if (!newCardNonce) {
+			// New-card mode: tokenize once per attempt WITH SCA verification, then
+			// reuse the cached nonce + verification token on retry (tokenization
+			// is one-shot; the backend idempotency key dedups). The verification
+			// token is amount-bound, so a changed amount forces a fresh
+			// tokenization.
+			if (!newCardNonce || newCardTokenAmount !== amountCents || Date.now() - newCardTokenizedAt > 240_000) {
 				try {
-					newCardNonce = await cardSelection.tokenize();
+					const tokenized = await cardSelection.tokenizeWithVerification(amountCents, {
+						givenName: authStore.currentUser?.firstName,
+						familyName: authStore.currentUser?.lastName,
+						email: authStore.currentUser?.email
+					});
+					newCardNonce = tokenized.nonce;
+					newCardVerificationToken = tokenized.verificationToken ?? '';
+					newCardTokenAmount = amountCents;
+					newCardTokenizedAt = Date.now();
 				} catch (_err) {
 					status = 'error';
 					const msg = _err instanceof Error ? _err.message : 'Card entry failed';
@@ -374,6 +395,7 @@
 				}
 			}
 			newCardToken = newCardNonce;
+			verificationToken = newCardVerificationToken || undefined;
 		} else {
 			status = 'error';
 			error = 'Please select a payment method';
@@ -405,6 +427,7 @@
 					payment_type: paymentType,
 					...(cardId ? { card_id: cardId } : {}),
 					...(newCardToken ? { new_card_token: newCardToken, save_card: saveCard } : {}),
+					...(verificationToken ? { verification_token: verificationToken } : {}),
 					idempotency_key: payIdempotencyKey
 				})
 			});
@@ -422,6 +445,9 @@
 			payKeyedType = '';
 			payKeyedCard = '';
 			newCardNonce = '';
+			newCardVerificationToken = '';
+			newCardTokenAmount = 0;
+			newCardTokenizedAt = 0;
 			paymentResult = {
 				id: data.id,
 				amount: data.amount,
@@ -777,6 +803,7 @@
 								)}
 							{/if}
 						</Button>
+						<p class="mt-4 text-center text-xs text-gray-500">Secure payment powered by Square</p>
 					</div>
 				{/if}
 
@@ -855,6 +882,7 @@
 								)}
 							{/if}
 						</Button>
+						<p class="mt-4 text-center text-xs text-gray-500">Secure payment powered by Square</p>
 					</div>
 				{/if}