Implement P11: Square Web Payments SDK new-card tokenization

Re-enable new-card entry across all 8 flows via Square Web Payments SDK
cnon: nonces (backend was already P11-ready):
- Add square.ts SDK loader (env-gated on VITE_SQUARE_APPLICATION_ID/LOCATION_ID,
  sandbox vs prod URL auto-derived from app-ID prefix) + SquareCardInput.svelte
  (tokenize() via bind:this, onReady state, CardEntryUnavailable fallback)
- CardSelection.svelte: replace newCardDisabled gate with new-card toggle +
  SquareCardInput; expose tokenize() for parent flows
- Wire new-card mode into tip x3, booking payment (UserPaymentModal), deposit
  (BookingFlow incl. guest), Buy a Gift Card + Add a Card (account), and admin
  till online_square (GiftCardsManagement create/topup)
- Retry-safe: each flow caches the one-shot nonce and reuses it on retry so the
  backend idempotency key dedups instead of re-tokenizing
- Docs: README, Gap Backlog P11, Feature Catalog, Technical Manual, P11 plan

.env.example

@@ -41,6 +41,14 @@ SQUARE_ENVIRONMENT=mock
 SQUARE_WEBHOOK_SIGNATURE_KEY=
 SQUARE_WEBHOOK_NOTIFICATION_URL=
 
+# Frontend (public — safe for the browser). Square Web Payments SDK:
+# VITE_SQUARE_APPLICATION_ID — client-side application ID (sandbox IDs start with "sandbox-")
+# VITE_SQUARE_LOCATION_ID    — Square location ID
+# VITE_SQUARE_ENVIRONMENT    — 'sandbox' | 'production' (optional; derived from the app ID prefix when omitted)
+VITE_SQUARE_APPLICATION_ID=
+VITE_SQUARE_LOCATION_ID=
+VITE_SQUARE_ENVIRONMENT=
+
 # Test Database (separate from main DB)
 # Used by testutils/testdb for running tests without corrupting dev data
 TEST_DB_HOST=localhost