fix: adversarial review round — replay-rescue double-charge, discount credit, 2FA/per-IP limits, snapshot encryption, refund reconciliation, VAT, frontend parity, tests+docs

Addresses the adversarial fresh-eyes audit (findings A1-A20) plus review-round fixes:
- CRITICAL A1: replay-by-key rescue cross-checks replayed CreatedAt; ccof blind-fail leaves pending with CRITICAL + notification instead of clawing back
- A2/A3/A4: till idempotency key restored to unconditional hash; tip rejected in CreateBookingPayment; campaign discount now reduces the charged amount (deposit credit)
- A5: admin notifications on blind-fail, manual-refund re-arm, cap-stranded charge-group, webhook FAILED/REJECTED refunds
- A6/A10: BuyGiftCard idempotency user-scoped; gift-card slot scan advances past failed rows
- A7/A14/A15: 2FA user+IP limiter, SNAPSHOT_ENC_KEY startup validation, accurate pepper/log-delivery docs
- A8/A9: snapshot encryption on all write+reuse sites; MPV->SPV effective voucher type (single VAT point)
- A11/A12/A13/A16: amount-aware refund reconciliation; completed-booking refund re-validation; till retry dedup; PaymentWasRefunded on SquareClient interface
- A17/A18/A19/A20: CI runs npm test; confirm_overflow_tip frontend dialog; unknown-event admin notification; mock token redaction
- M7 ConfirmOverflowTip, M9 snapshot encryption, C1 discount ordering regression test
- Frontend vitest framework (41 tests), backend coverage for fixed functions, docs corrected (2,269 tests, SUPPORT_EMAIL tokens, resolution status)

All 25 backend packages pass; frontend 41/41; build + env-docs green.

backend/handlers/webhooks/webhooks_test.go

@@ -272,6 +272,7 @@ func TestHandleSquareWebhook_UnknownEventType(t *testing.T) {
 	}
 	body, _ := json.Marshal(event)
 	sig := webhookTestEnv(t, body)
+	notifBefore := countCriticalNotifications(t)
 	w := makeWebhookRequest(body, sig, context.Background())
 	if w.Code != http.StatusNotImplemented {
 		t.Errorf("expected 501 Not Implemented for unknown event type, got %d. body: %s", w.Code, w.Body.String())
@@ -284,21 +285,28 @@ func TestHandleSquareWebhook_UnknownEventType(t *testing.T) {
 	if n := countWebhookEvents(t, event.EventID); n != 0 {
 		t.Errorf("expected no dedup row for an unhandled event type (Square must retry), got %d", n)
 	}
+	// A19: the event must still surface in the admin notification centre —
+	// without it, after Square's ~24h retry window the event is silently gone.
+	// The notification is a SEPARATE table, so the no-dedup-row assertion above
+	// still holds.
+	if n := countCriticalNotifications(t) - notifBefore; n != 1 {
+		t.Errorf("expected exactly 1 critical_payment_log admin notification for the unknown event (A19), got %d", n)
+	}
 }
 
 // TestHandleSquareWebhook_KnownNonMoneyEvent_Acknowledged verifies a signed
 // event from a KNOWN NON-MONEY family this app will never process
-// (e.g. invoice.created) is deliberately acknowledged 200 WITH a committed
+// (e.g. customer.created) is deliberately acknowledged 200 WITH a committed
 // dedup row so Square stops retrying it. These events carry no money state the
 // app tracks, so acking loses nothing — and retrying them would fill the
 // subscription's retry queue until Square suspends it, silently killing
 // money-event delivery (payment.created/updated). The ack is logged at WARN.
 func TestHandleSquareWebhook_KnownNonMoneyEvent_Acknowledged(t *testing.T) {
 	event := SquareWebhookEvent{
-		Type:      "invoice.created",
+		Type:      "customer.created",
 		EventID:   "evt_nonmoney_1",
 		CreatedAt: "2025-01-01T00:00:00Z",
-		Data:      json.RawMessage(`{"id":"inv_1"}`),
+		Data:      json.RawMessage(`{"id":"cust_1"}`),
 	}
 	body, _ := json.Marshal(event)
 	sig := webhookTestEnv(t, body)
@@ -341,6 +349,7 @@ func TestHandleSquareWebhook_UnhandledMoneyEvent_NotAcknowledged(t *testing.T) {
 	}
 	body, _ := json.Marshal(event)
 	sig := webhookTestEnv(t, body)
+	notifBefore := countCriticalNotifications(t)
 	w := makeWebhookRequest(body, sig, context.Background())
 	if w.Code != http.StatusNotImplemented {
 		t.Errorf("expected 501 Not Implemented for unhandled money-family event, got %d. body: %s", w.Code, w.Body.String())
@@ -353,6 +362,11 @@ func TestHandleSquareWebhook_UnhandledMoneyEvent_NotAcknowledged(t *testing.T) {
 	if n := countWebhookEvents(t, event.EventID); n != 0 {
 		t.Errorf("expected no dedup row for an unhandled money-family event (Square must retry), got %d", n)
 	}
+	// A19: the unhandled money event must still surface in the admin
+	// notification centre before the retry window closes.
+	if n := countCriticalNotifications(t) - notifBefore; n != 1 {
+		t.Errorf("expected exactly 1 critical_payment_log admin notification for the unhandled money-family event (A19), got %d", n)
+	}
 }
 
 func TestHandleSquareWebhook_InvalidJSON(t *testing.T) {