Harden money-safety re-review findings: nonce-independent idempotency keys, reconciliation-required logging, terminal-state classification

Re-review (2 Oracle + security + QA + librarian + context-miner) surfaced fixes, all applied: (1) UserPaymentModal and the account-page gift-card buy now key the cached idempotency key on a stable 'new-card' sentinel instead of the cnon: nonce, so clearing the nonce on a failed charge no longer regenerates the key — a lost-response retry now dedups at Square instead of double-charging (the tip flows already keyed on amount only). (2) The create-with-redeem clawback now logs CRITICAL when the guarded balance reversal is blocked (previously silent), and its transaction DELETE is scoped to this sale instead of deleting every transaction on the card. (3) reconcileStalePaymentAtSquare now treats APPROVED/PENDING as non-terminal (leave pending) instead of definitively failed, matching Square's documented state machine. (4) GetTillCheckoutStatus returns 404 for a sale already swept to failed instead of reporting a live state. (5) The critical-payment scan job skips candidates whose booking was hard-deleted, so one orphan can no longer silence all critical alerts.

backend/internal/jobs/cleanup.go

@@ -329,6 +329,14 @@ func ScanCriticalPaymentLogs(ctx context.Context) (int, error) {
 			  AND an.booking_id IS NOT DISTINCT FROM src.booking_id
 			  AND an.acknowledged_at IS NULL
 		)
+		-- admin_notifications.booking_id is a hard FK to bookings(id); a
+		-- candidate whose booking was hard-deleted (7-year retention) would
+		-- otherwise fail the whole INSERT and silently kill ALL critical
+		-- alerts. Skip orphans: keep NULL booking_ids (till sales) and only
+		-- payments/refunds whose booking still exists.
+		AND (src.booking_id IS NULL OR EXISTS (
+			SELECT 1 FROM bookings b WHERE b.id = src.booking_id
+		))
 	`)
 	if err != nil {
 		return 0, fmt.Errorf("failed to scan critical payment logs: %w", err)