Fix payment review round 3: saved-card idempotency, stale-pending sweep, webhook fail-closed

R1/R4: saved_card branch in CreateTerminalPayment now mirrors CreateTipPayment
- advisory lock (crussell:payment:<bookingID>) serializes concurrent double-clicks
- deterministic key bookingID-sc-type-amount-cardID (<=45 chars) so a lost-response
  retry derives the same key and dedups instead of double-charging
- idempotency switch inside the lock: completed -> dedup, pending -> reuse with
  pence amount-guard, failed -> clean 409
- success response includes card_brand/card_last4 (frontend already reads them)

R2: add 'failed' case to all four retry switches (tip, booking, gift card, till)
- a swept/definitively-rejected record returns 409 instead of 500-ing on the
  idempotency_key UNIQUE constraint

R3: extend SweepStalePendingPayments to till_sales card rows
- sweeps pending till_sales (online_square/in_person_card) past Square's ~24h
  key retention, closing the double-charge window for till sales
- swept rows logged with the same CRITICAL manual-reconciliation marker as the
  refund sweep

Webhook fail-closed: reject 503 when SQUARE_WEBHOOK_SIGNATURE_KEY unset, 403 on
bad signature (was: skip verification in dev)

Refund status resolution: refunds now resolve by Square status
(COMPLETED/PENDING/FAILED/REJECTED) instead of assuming completed; real error
codes (REFUND_AMOUNT_INVALID, PAYMENT_NOT_REFUNDABLE, REFUND_ALREADY_PENDING)
added to the definitive/processed classification

HTTP client: CreateCard key truncated to <=45 chars, device_options always sent
(env SQUARE_TERMINAL_DEVICE_ID fallback), processing_fee reads amount_money,
ListCards cursor loop, refund keys hashed to <=45 chars

Other fixes: payment/till/gift-card advisory-lock + FOR UPDATE asymmetries,
GetPaymentByID NULL scans, loyalty redemption lock, card upsert on conflict,
mock ccof: prefix parity, IsValidSquareCheckoutID for real Square IDs,
isAdminRequest defense-in-depth on all 6 admin payment handlers, webhook
signature docs, M8/L5 debug markers removed

Docs: README/FC/TM/Overview updated (22 jobs, 20 CRITICAL sites, 23-section
GDPR export, sweep jobs, webhook fail-closed); P11 plan marks remaining items
(sandbox smoke test, M-8 customer_id, saved-card key dedup trade-off) as
deferred with rationale; gap backlog pruned of completed items

backend/internal/jobs/cleanup.go

@@ -56,6 +56,16 @@ func RegisterAll(s *Scheduler) {
 		Handler:     payments.SweepPendingSquareRefunds,
 	})
 
+	// Offset from the refund sweep (which also writes payments rows) by one
+	// minute to avoid the two sweeps contending on the same table.
+	s.Register(Job{
+		Name:        "sweep-stale-pending-payments",
+		Schedule:    "1,6,11,16,21,26,31,36,41,46,51,56 * * * *",
+		Timeout:     60 * time.Second,
+		Concurrency: 1,
+		Handler:     payments.SweepStalePendingPayments,
+	})
+
 	// === MID FREQUENCY — every minute (progressive rate limiter was on 30s) ===
 
 	s.Register(Job{

backend/internal/jobs/scheduler_test.go

@@ -413,8 +413,8 @@ func TestRegisterAll_RegistersExpectedJobs(t *testing.T) {
 	s := New()
 	RegisterAll(s)
 
-	if got := len(s.registry); got != 21 {
-		t.Fatalf("RegisterAll() registered %d jobs, want 21", got)
+	if got := len(s.registry); got != 22 {
+		t.Fatalf("RegisterAll() registered %d jobs, want 22", got)
 	}
 
 	registered := make(map[string]Job, len(s.registry))
@@ -473,6 +473,7 @@ func expectedJobNames() map[string]bool {
 		"cleanup-rate-limiters":               true,
 		"cleanup-gdpr-export-cache":           true,
 		"sweep-pending-square-refunds":        true,
+		"sweep-stale-pending-payments":        true,
 		"cleanup-progressive-rate-limiter":    true,
 		"cleanup-expired-loyalty-redemptions": true,
 		"cleanup-old-idempotency-keys":        true,