fix: adversarial review round — replay-rescue double-charge, discount credit, 2FA/per-IP limits, snapshot encryption, refund reconciliation, VAT, frontend parity, tests+docs

Addresses the adversarial fresh-eyes audit (findings A1-A20) plus review-round fixes:
- CRITICAL A1: replay-by-key rescue cross-checks replayed CreatedAt; ccof blind-fail leaves pending with CRITICAL + notification instead of clawing back
- A2/A3/A4: till idempotency key restored to unconditional hash; tip rejected in CreateBookingPayment; campaign discount now reduces the charged amount (deposit credit)
- A5: admin notifications on blind-fail, manual-refund re-arm, cap-stranded charge-group, webhook FAILED/REJECTED refunds
- A6/A10: BuyGiftCard idempotency user-scoped; gift-card slot scan advances past failed rows
- A7/A14/A15: 2FA user+IP limiter, SNAPSHOT_ENC_KEY startup validation, accurate pepper/log-delivery docs
- A8/A9: snapshot encryption on all write+reuse sites; MPV->SPV effective voucher type (single VAT point)
- A11/A12/A13/A16: amount-aware refund reconciliation; completed-booking refund re-validation; till retry dedup; PaymentWasRefunded on SquareClient interface
- A17/A18/A19/A20: CI runs npm test; confirm_overflow_tip frontend dialog; unknown-event admin notification; mock token redaction
- M7 ConfirmOverflowTip, M9 snapshot encryption, C1 discount ordering regression test
- Frontend vitest framework (41 tests), backend coverage for fixed functions, docs corrected (2,269 tests, SUPPORT_EMAIL tokens, resolution status)

All 25 backend packages pass; frontend 41/41; build + env-docs green.

backend/handlers/payments/completion.go

@@ -339,8 +339,15 @@ func ApplyBookingCompletionSideEffects(ctx context.Context, tx pgx.Tx, bookingID
 }
 
 // bookingIsFullyPaid reports whether completed payments toward the booking
-// (excluding tips, discounts and on-the-house rows — the same definition as
-// GetBookingPaymentInfo.TotalPaid) cover 100% of the booking total.
+// (excluding tips and on-the-house rows, but INCLUDING discount rows) cover
+// 100% of the booking total. A discount row represents real value applied
+// toward the booking: the customer's total obligation is the DISCOUNTED total,
+// so a booking is fully paid when real money + applied discounts == total
+// (e.g. a 10% campaign on a £50 booking completes once £45 + £5 discount is
+// recorded). Tips are excluded (gratuity, not payment toward the booking) as
+// are on-the-house rows (no real value moved). This deliberately differs from
+// GetBookingPaymentInfo.TotalPaid, which excludes discount rows because the
+// deposit/balance SPLIT must run against the full total and real money only.
 func bookingIsFullyPaid(ctx context.Context, q db.Querier, bookingID string) bool {
 	var fullyPaid bool
 	if err := q.QueryRow(ctx, `
@@ -352,7 +359,7 @@ func bookingIsFullyPaid(ctx context.Context, q db.Querier, bookingID string) boo
 			FROM payments
 			WHERE booking_id = $1 AND status = 'completed'
 			  AND payment_type != 'tip'
-			  AND payment_method NOT IN ('discount', 'on_the_house')
+			  AND payment_method NOT IN ('on_the_house')
 		)
 		SELECT pt.paid_cents >= bt.total_cents AND bt.total_cents > 0
 		FROM booking_total bt, paid_total pt